ATT&CK coverage › Technique

Indicator Removal T1070

Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.

Events covered

12 catalog events are tagged with this technique by at least one rule.

ProviderEvent IDTitle
Sysmon1Process creation
Sysmon2A process changed a file creation time
Sysmon7Image loaded
Sysmon14RegistryEvent (Key and Value Rename)
Sysmon23FileDelete (File Delete archived)
Sysmon26FileDeleteDetected (File Delete logged)
Security-Auditing4688A new process has been created.
Security-Auditing4719System audit policy was changed.
Defender-DeviceProcessEvents9001000Process activity (any)
Eventlog104The LogFileCleared.Channel log file was cleared.
Eventlog1102The audit log was cleared.
PowerShell4104Creating Scriptblock text (MessageNumber of MessageTotal).

Authoring guide

Patterns shared across the 24 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (21 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
CommandLine10match 9, ends_with 1, eq 1unload, CL, WEVTUTIL, 127.0.0.1, -n 6
Image8ends_with 6, starts_with 1, eq 1\fltMC.exe, \powershell.exe, \pwsh.exe, C:\Windows\, \fsutil.exe
OriginalFileName6eq 6fltMC.exe, fsutil.exe, powershell_ise.exe, cmd.exe, powershell.exe
TargetFilename5ends_with 3, match 3, starts_with 2C:\Windows\System32\winevt\Logs\, .evtx, \Logging\CmdletInfra\LocalPowerShell\Cmdlet\, _Cmdlet_, \inetpub\logs\LogFiles\
EventType2in 1, eq 1Log clear, audit-log-cleared, DeleteValue, DeleteKey
EventID2eq 21102, 1
ScriptBlockText2match 2Clear-History, (Get-PSReadlineOption).HistorySavePath, Remove-Item, Set-EtwTraceProvider , Remove-EtwTraceProvider
file.extension1eq 1lnk, dll, msi
file.path1wildcard 1?:\Windows\SysWOW64\*, ?:\Users\*\AppData\Roaming\Microsoft\Windows\Start..., ?:\Users\Public\*
Provider_Name1eq 1Microsoft-Windows-Sysmon
AuditPolicyChangesDescription1eq 1, in 1Success removed, Success Added
SubCategory1in 1Process Creation, Security Group Management, User Account Management
Channel1in 1System, Security
LogClearCount1gt 110
EventSourceName1eq 1Microsoft-Windows-Eventlog

Top indicator values (136 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

FieldKindValueRules (here)Corpus reach
OriginalFileNameeqfltMC.exe22
Imageends_with\fltMC.exe22
CommandLinematchunload22
Imageends_with\powershell.exe2143
Imageends_with\pwsh.exe2140
OriginalFileNameeqpwsh.dll272
CommandLinematchdelete27
file.pathwildcard?:\Windows\System32\*1
file.extensioneqexe1
Provider_NameeqMicrosoft-Windows-Sysmon13
file.extensioneqlnk1
file.extensioneqmsi1
file.pathwildcard?:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*1
file.extensioneqsys1
file.pathwildcard?:\ProgramData\*1
file.pathwildcard?:\Users\Public\*1
file.pathwildcard?:\Windows\SysWOW64\*1
file.extensioneqscr1
file.extensioneqdll1
file.pathwildcard?:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\*1

Common exclusions (13 distinct)

Field/operator/value combinations that rules under this technique routinely exclude (top-level not() clauses). These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths.

FieldKindValueRules excluding
usereqNetwork Service1
Imagewildcard?:\Windows\system32\cleanmgr.exe1
Imagewildcard?:\Windows\System32\Robocopy.exe1
Imagewildcard?:\Program Files\*1
file.pathstarts_with?:\Windows\System32\spool\1
Imagewildcard?:\Windows\syswow64\msiexec.exe1
usereqSYSTEM1
Imagewildcard?:\Windows\SysWOW64\Robocopy.exe1
usereqLocal Service1
Imagewildcard?:\Windows\system32\svchost.exe1
Imageeq?:\Windows\System32\spoolsv.exe1
Imagewildcard?:\Windows\system32\msiexec.exe1
Imagewildcard?:\Program Files (x86)\*1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 16 rules

Elastic 3 rules

Splunk 1 rule

Kusto Query Language 4 rules