T1070
Indicator Removal
Adversaries may delete or alter artifacts generated during an intrusion to remove evidence of their presence or hinder incident response.
ATT&CK / Defense Evasion
Defense strategies
- Centralized logging
- Write-once log storage
- File integrity monitoring
- Backup critical logs
Detection methods
- Monitor for log clearing events
- Detect timestamp manipulation
- Track file deletions in sensitive areas
D3FEND mappings
1