T1070 Indicator Removal Defensive Guide: Detecting Clean-Up and Protecting Evidence

Attackers clean up after themselves, and every deleted tool, wiped history file or altered timestamp makes the investigation slower, less certain and more expensive. MITRE ATT&CK T1070 Indicator Removal covers the selective deletion or modification of artefacts an intrusion leaves behind: files, command histories, timestamps, share connections, network history, mailbox data and persistence. In ATT&CK v19 and v20 it sits in the Stealth tactic (TA0005), and wholesale log clearing moved out of it into T1685 Disable or Modify Tools. This guide covers the eight v20 sub-techniques, how to detect clean-up as it happens, and how to keep evidence beyond the attacker's reach with off-host and immutable storage. It is for SOC analysts, DFIR teams and logging platform owners, and covers defence only.

Key takeaways

• Selective, not wholesale. v20 describes T1070 as removing the artefacts most likely to draw attention "while leaving sufficient data intact to maintain the appearance of normal system behavior". Expect gaps, not empty logs.
• Log clearing has moved. Clearing Windows event logs and Unix system logs is now T1685.005 and T1685.006 under Defense Impairment; update rule tags and coverage reports.
• The clean-up is evidence. File deletion, history truncation and timestamp changes are themselves logged by Sysmon, auditd and cloud audit trails, often with better fidelity than the activity they hide.
• Evidence must leave the host. ATT&CK's main mitigation is remote data storage (M1029): forward events quickly to a store the attacker cannot edit, ideally write-once.
• Forensics still recovers a lot. ATT&CK notes removed artefacts "may still be recoverable through deeper forensic analysis"; forensic readiness decides whether you can.

How the attack works

After achieving its goal at a stage of an intrusion, an adversary removes or alters artefacts that tie the activity to them. The location and format of each artefact is platform-specific, so the clean-up is tailored to blend with expected user or system activity. The aim is to delay recognition and lower alert fidelity rather than to erase everything.

The parent technique has its own strategy, DET0184, for behaviour that spans sub-techniques. For how Windows log channels work and which events to collect, see the Windows Event Log Guide; for the related impairment techniques, see the T1685 Disable or Modify Tools Defensive Guide.

Where it shows up

• State-sponsored long dwell operations: ATT&CK records APT29 removing its tools once access was achieved and timestomping backdoors to match Windows files during the SolarWinds compromise, and removing evidence of mailbox export requests.
• Living off the land intrusions: CISA's advisory AA24-038A describes Volt Typhoon deleting working files and directories and clearing selected logs and artefacts.
• Network infrastructure: ATT&CK records Salt Typhoon reverting network configuration files, clearing history and logs and removing persistence after use.
• Email and identity: ATT&CK records Scattered Spider deleting emails that warned users about suspicious account activity, so the victim never saw the alert.
• Ransomware: T1070.004 is used by more than 60 groups and campaigns in ATT&CK v20, including Play, BlackByte and INC Ransom.

Impact

• Longer dwell time: fewer artefacts on disk means fewer hits for scans, hunts and YARA sweeps.
• Weaker scoping: responders cannot prove which systems or data were touched, which can widen breach notifications or leave access in place.
• Misleading timelines: timestomping pushes malicious files outside the investigation window, a classic cause of missed persistence.
• Lost user warnings: deleted security notification emails remove one of the few signals the account owner would see.

Detection

Detect the act of removal, then use what it targeted as a lead. The table below combines the v20 analytics with vendor event references.

Sysmon 23 keeps a copy of deleted files in its archive directory (default C:\Sysmon), which can grow very large, so scope it to high-value paths and extensions. Sysmon 26 logs deletion without the copy. See the Sysmon Guide and the Linux Logging and auditd for Defenders Guide.

Hunting for what is missing

• Gaps: interactive sessions with no history entries, hosts with execution telemetry but no matching file creation, or shell.log shorter than its previous size.
• Cross-source mismatch: a process or network connection in EDR or flow logs with no matching host artefact.
• Short-lived objects: services, tasks and accounts that existed for minutes. See the Anti-Forensics Detection Guide and the Forensic Timeline Analysis Guide.

Metrics

• Forwarding latency: median seconds from event creation to arrival in the central store; the shorter it is, the less local clean-up can remove.
• Immutable coverage: share of security-relevant log sources written to WORM or integrity-validated storage.
• Deletion telemetry coverage: share of servers and workstations with Sysmon 23 or 26, or auditd deletion rules, on high-value paths.
• Short-lived artefact alerts: number per month and percentage triaged within one working day.
• Recovery rate in exercises: share of emulated clean-up actions that responders could reconstruct from central logs.

Prevention and hardening

Indicator removal cannot be fully prevented on a host the attacker controls, so the goal is to make local clean-up irrelevant.

• Remote data storage (M1029): forward events promptly. ATT&CK advises minimising delay "to avoid prolonged storage on the local system".
• Write-once storage: S3 Object Lock in compliance mode means a protected object version cannot be overwritten or deleted by any user, including the root user, until its retain-until date; governance mode allows bypass by users with s3:BypassGovernanceRetention. Azure locked time-based retention policies cannot be deleted or shortened, only extended. Test in governance or unlocked mode, then lock. See the Log Management and Retention Guide.
• Integrity validation: CloudTrail log file validation detects modified or deleted log files and delivery gaps using SHA-256 hashes and signed hourly digests.
• Protect local copies (M1022, M1041): restrict permissions on local log and history files, and encrypt event files locally and in transit so the attacker gets no feedback on what was captured.
• Capture history centrally: PowerShell script block logging, with Protected Event Logging so captured secrets are encrypted to a key held only by the collector, plus auditd execve rules, keep command evidence beyond history files. See the PowerShell Security Guide.
• Mailbox auditing: keep mailbox audit on for all users and alert on bypass settings and export clean-up. See the Microsoft 365 Unified Audit Log Guide.

Choosing storage by organisation size

Phased rollout

1. Map evidence: list artefacts per platform that responders depend on, and where each is stored.
2. Forward and measure: ship them centrally and record forwarding latency.
3. Add deletion telemetry: Sysmon 23 or 26 and auditd rules on high-value paths, in a pilot ring first to size volume.
4. Lock storage: enable WORM in a test bucket or container, validate retention and cost, then lock production. Rollback before locking is policy removal; after locking there is none, by design.
5. Exercise: run an authorised clean-up emulation and check what responders recover. See the Forensic Readiness Guide.

Lessons from incidents

• Device logs are easy to clear and rarely forwarded: the Salt Typhoon telecom intrusions involved a custom tool that captured traffic across device chains while clearing logs. Off-device syslog and configuration backups for comparison are the counter.
• Investigate every 1102: CISA's Volt Typhoon advisory says logs are generally not cleared, so every Security log cleared event deserves investigation; it also notes ESENT application logs can persist longer than Security logs.
• Timestamps can lie: ATT&CK records APT29 timestomping backdoors to match legitimate Windows files during the SolarWinds compromise. A timeline built only on one set of file times would place those files outside the window; compare NTFS timestamp sets and use central execution logs.

Framework mapping

Where identity fits

Clean-up runs under an identity: the account that deletes files, removes a persistence service or purges mailbox exports. T1070.009 explicitly includes deleting accounts created for persistence, and T1070.008 often uses privileged Exchange roles. Alert on account deletions shortly after creation, record who holds export and purge rights, and keep identity provider logs in the same immutable store. See the MITRE ATT&CK T1136 Create Account Guide.

Practitioner checklist

• Retag log-clearing content to T1685.005 and T1685.006 and keep T1070 for selective clean-up.
• Forward host, identity, mailbox and device logs centrally and track forwarding latency.
• Store security logs in WORM or integrity-validated storage, tested before locking.
• Enable Sysmon 23 or 26 and auditd deletion rules on high-value paths.
• Collect PowerShell 4104 with Protected Event Logging and Linux execve records.
• Alert on short-lived services, tasks and accounts, and on mailbox export clean-up.
• Back up network device configurations and compare them on a schedule.
• Run a clean-up emulation each year and measure what responders can reconstruct.

Standards and references

• MITRE ATT&CK: Indicator Removal (T1070)
• MITRE ATT&CK: File Deletion (T1070.004)
• MITRE ATT&CK: Timestomp (T1070.006)
• CISA: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A)
• Microsoft Learn: Sysmon
• AWS: Locking objects with Object Lock
• Microsoft Learn: Store business-critical blob data with immutable storage
• AWS: Validating CloudTrail log file integrity

Related NHI Mgmt Group resources: Windows Event Log Guide · Anti-Forensics Detection Guide · ATT&CK Stealth and Defense Impairment Tactics Guide · Digital Forensics (DFIR) Guide · Cloud Logging and Audit Trail Guide