T1070Stealth
Indicator Removal
Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior. Artifacts such as command…
CVEs3
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.3
Reports0
Detections
20 Sigma rules tagged T1070Indicator RemovalT107020 general rules
- Fsutil Suspicious Invocationhighstable
- Shadow Copies Deletion Using Operating Systems Utilitieshighstable
- Clearing Windows Console Historyhightest
- Disable of ETW Trace - Powershellhightest
- ETW Trace Evasion Activityhightest
- Exchange PowerShell Cmdlet History Deletedhightest
- Remove Exported Mailbox from Exchange Webserverhightest
- Sysmon Driver Unloaded Via Fltmc.EXEhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Indicator Removal
3 CVEs, by priority. Each link shows its badge.- CVE-2021-45382D-Link Multiple Routers Remote Code Execution VulnerabilityD-Link · Multiple RoutersKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+4 moreMITRE CTID mapping of the KEV entry · follow-on activity97.8%Top 0.09%69.8priority
- CVE-2023-1389TP-Link Archer AX-21 Command Injection VulnerabilityMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.01%69.2priority
- CVE-2022-41128Microsoft Windows Scripting Languages Remote Code Execution VulnerabilityMITRE CTID mapping of the KEV entry · follow-on activity24.6%Top 2.1%63.7priority
Linked through a sub-technique
5 more- CVE-2020-5902F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution VulnerabilityF5 · BIG-IPKEVRansomwarePublic exploitCritical · 9.8T1133External Remote ServicesT1190Exploit Public-Facing Application+5 more · 5 reports>99.9%Top 0.01%89.9priority
- CVE-2021-40539Zoho ManageEngine ADSelfService Plus Authentication Bypass VulnerabilityZoho · ManageEngineKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1047Windows Management Instrumentation+11 more · 1 report99.0%Top 0.07%83.7priority
- CVE-2025-32756Fortinet Multiple Products Stack-Based Buffer Overflow VulnerabilityFortinet · Multiple ProductsKEVPublic exploitCritical · 9.8T1608.001Upload MalwareT1133External Remote Services+5 more30.9%Top 1.7%79.5priority
- CVE-2021-44077Zoho ManageEngine ServiceDesk Plus Remote Code Execution VulnerabilityZoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter PlusKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1047Windows Management Instrumentation+11 more93.3%Top 0.16%69.8priority
- CVE-2023-22952Multiple SugarCRM Products Remote Code Execution VulnerabilitySugarCRM · Multiple ProductsKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1078Valid Accounts+7 more80.1%Top 0.38%69.1priority