T1070 Indicator Removal on Host Mappings

Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as Bash History and /var/log/*.

These actions may interfere with event collection, reporting, or other notifications used to detect intrusion activity. This may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.



Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
chronicle Chronicle technique_scores T1070 Indicator Removal on Host
security_command_center Security Command Center technique_scores T1070 Indicator Removal on Host

ATT&CK Subtechniques

Technique ID Technique Name Number of Mappings
T1070.002 Clear Linux or Mac System Logs 1
T1070.001 Clear Windows Event Logs 1
T1070.004 File Deletion 1
T1070.006 Timestomp 1