Indicator Removal
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
Every leg of every analytic in this brief is a child's mechanism, and none of them is parent-level. AN0520 (Windows): Security 1102 is the audit-log clear that is T1070.001; Sysmon EID 23 file_delete is T1070.004; the Sysmon EID 13/14 registry legs are persistence-artefact removal (T1070.009, already published) and network-connection history removal (T1070.007). AN0521 (Linux): clearing or truncating.bash_history is T1070.003; unlink/rename of /var/log/messages and /var/log/audit/audit.log is T1070.002. AN0522 (macOS): clearing the unified log is T1070.002; removing LaunchAgent/LaunchDaemon plists is T1070.009 and the Terminal-history leg is T1070.003. Nothing observable remains that is not one of those, and a rule tagged attack.t1070 firing on Security 1102 or on a bash_history unlink would mislabel a child's event. […]
Covered instead by T1685.005 (was T1070.001), T1685.006 (was T1070.002), T1070.003, T1070.004, T1070.007, T1070.009.
What the technique is
Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior. Artifacts such as command histories, log entries, or file metadata may be altered in ways that align with expected user or system activity. Location, format, and type of artifact (such as command or login history) are often platform-specific, allowing adversaries to tailor modifications that minimize suspicion. These actions may not prevent detection entirely but can delay recognition of malicious activity or reduce the fidelity of alerts by making events appear benign or consistent with routine operations. Additionally, selectively removed or modified artifacts may still be recoverable through deeper forensic analysis, though their absence or alteration can complicate timeline reconstruction and attribution.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0520
Monitors sequences involving deletion/modification of logs, registry keys, scheduled tasks, or prefetch files following suspicious process activity or elevated access escalation.
- AN0521
Detects deletion or overwriting of bash history, syslog, audit logs, and.ssh metadata following privilege elevation or suspicious process spawning.
- AN0522
Detects clearing of unified logs, deletion of plist files tied to persistence, and manipulation of Terminal history after initial execution.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.