1. Home
  2. ATT&CK Techniques
  3. T1070 Indicator Removal

T1070 Indicator Removal Mappings

Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.

Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity. This may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
AC-16 Security and Privacy Attributes Protects T1070 Indicator Removal
AC-17 Remote Access Protects T1070 Indicator Removal
AC-18 Wireless Access Protects T1070 Indicator Removal
AC-02 Account Management Protects T1070 Indicator Removal
AC-03 Access Enforcement Protects T1070 Indicator Removal
AC-05 Separation of Duties Protects T1070 Indicator Removal
AC-06 Least Privilege Protects T1070 Indicator Removal
CA-07 Continuous Monitoring Protects T1070 Indicator Removal
CM-02 Baseline Configuration Protects T1070 Indicator Removal
CM-06 Configuration Settings Protects T1070 Indicator Removal
CP-06 Alternate Storage Site Protects T1070 Indicator Removal
CP-07 Alternate Processing Site Protects T1070 Indicator Removal
CP-09 System Backup Protects T1070 Indicator Removal
SC-36 Distributed Processing and Storage Protects T1070 Indicator Removal
SC-04 Information in Shared System Resources Protects T1070 Indicator Removal
SI-12 Information Management and Retention Protects T1070 Indicator Removal
SI-23 Information Fragmentation Protects T1070 Indicator Removal
SI-03 Malicious Code Protection Protects T1070 Indicator Removal
SI-04 System Monitoring Protects T1070 Indicator Removal
SI-07 Software, Firmware, and Information Integrity Protects T1070 Indicator Removal
PUR-IP-E5 Information Protection Technique Scores T1070 Indicator Removal
Comments
Defender for Cloud Apps file policies allow you to enforce a wide range of automated processes. Policies can be set to provide Information Protection, including continuous compliance scans, legal eDiscovery tasks, and DLP for sensitive content shared publicly. Information Protection Protects from Indicator Removal attacks due to it encrypting files containing personally identifying information and other sensitive data that is shared in a cloud app and applying sensitivity labels to limit access only to employees in your company. License Requirements: Microsoft Defender for Office 365 plan 1 and plan 2
References
  1. https://learn.microsoft.com/en-us/defender-cloud-apps/policies-information-protection
PUR-AS-E5 Audit Solutions Technique Scores T1070 Indicator Removal
Comments
Microsoft Purview auditing solutions provide an integrated solution to help organizations effectively respond to security events, forensic investigations, internal investigations, and compliance obligations. Thousands of user and admin operations performed in dozens of Microsoft 365 services and solutions are captured, recorded, and retained in your organization's unified audit log. Audit records for these events are searchable by security ops, IT admins, insider risk teams, and compliance and legal investigators in your organization. This capability provides visibility into the activities performed across your Microsoft 365 organization. Microsoft's Audit Solutions detects Indicator Removal attacks due to the File and Page Audit Log activities which monitors for newly constructed files, for contextual data about files, and for changes made to files. License Requirements: Microsoft 365 E3 and E5
References
  1. https://learn.microsoft.com/en-us/purview/audit-log-activities
  2. https://learn.microsoft.com/en-us/purview/audit-solutions-overview

ATT&CK Subtechniques

Technique ID Technique Name Number of Mappings
T1070.002 Clear Linux or Mac System Logs 21
T1070.007 Clear Network Connection History and Configurations 10
T1070.003 Clear Command History 10
T1070.008 Clear Mailbox Data 24
T1070.001 Clear Windows Event Logs 21
T1070.009 Clear Persistence 10