T1070 Indicator Removal

Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. MITRE ATT&CK

3 programs on CmdID 8 Sigma rules T1070 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK

T1070.003Indicator Removal: Clear Command History

T1070.004Indicator Removal: File Deletion

T1070.005Indicator Removal: Network Share Connection Removal

T1070.006Indicator Removal: Timestomp

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

fltmc.exeits Sigma rules fsutil.exeits Sigma rules update.exeExecute

Sigma rules tagged with it

process creation, the highest levels first

highETW Trace Evasion Activity@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community · Windows

highFsutil Suspicious InvocationEcco, E.M. Anhaus, oscd.community · Windows

highShadow Copies Deletion Using Operating Systems UtilitiesFlorian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades) · Windows

highSysmon Driver Unloaded Via Fltmc.EXEKirill Kiryanov, oscd.community · Windows

mediumFilter Driver Unloaded Via Fltmc.EXENasreddine Bencherchali (Nextron Systems) · Windows

mediumIIS WebServer Log Deletion via CommandLine UtilitiesSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumPotential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE@neu5ron · Windows

lowLinux Package UninstallTuan Le (NCSGroup), Nasreddine Bencherchali (Nextron Systems) · Linux

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Remove a package on the page for apt-get

sudo apt-get remove packageIdentify

Remove a package on the page for dpkg

sudo dpkg --remove packageIdentify

Add the Fedora non-free packages repository on the page for dnf-install

sudo dnf [in https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpmIdentify

To delete the oldest shadow copy of volume C, type on the page for vssadmin delete shadows

vssadmin delete shadows /for=c: /oldestIdentify

To delete all client-accessible shadow copies of volume D, type on the page for vssadmin delete shadows

vssadmin delete shadows /for=d: /allIdentify

To delete a single client-accessible shadow copy by its ID, first run vssadmin list shadows to find the shadow copy ID. Then run the following command, replacing c: with the volume that hosts the shadow copy and <ShadowID> with the ID you want to delete. Enter the ID in the format XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX, where each X is a hexadecimal character on the page for vssadmin delete shadows

vssadmin delete shadows /for=c: /shadow=<ShadowID>Identify

To delete all client-accessible shadow copies of volume D without showing progress messages, add the /quiet parameter on the page for vssadmin delete shadows

vssadmin delete shadows /for=d: /all /quietIdentify

To resize shadow copy of volume C on volume D, with a maximum size of 900MB, type on the page for vssadmin resize shadowstorage

vssadmin resize shadowstorage /For=C: /On=D: /MaxSize=900MBIdentify

To resize shadow copy of volume C on volume D, with no maximum size, type on the page for vssadmin resize shadowstorage

vssadmin resize shadowstorage /For=C: /On=D: /MaxSize=UNBOUNDEDIdentify

To resize shadow copy of volume C by 20%, type on the page for vssadmin resize shadowstorage

vssadmin resize shadowstorage /For=C: /On=C: /MaxSize=20%Identify

An example is here when CmdID’s reading of it names T1070: a Sigma rule it trips is tagged with it, or its abuse is documented as it.