Indicator Removal

What is Indicator Removal?

Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary's actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings, images, or data contained in files, keys in the registry, credentials, or other relevant security artifacts created while the adversary is present. Indicator removal includes techniques such as clearing Windows Event Logs, deleting security logs from network devices, removing Prefetch files, clearing bash history, modifying file timestamps, and deleting temporary files created during attack execution. The goal is to reduce forensic evidence available to incident responders and to prevent security monitoring systems from triggering alerts based on artifacts left behind during the intrusion.

“Indicator Removal is documented as technique T1070 in the MITRE ATT&CK knowledge base under the Defense Evasion tactic. Detection requires visibility into SIEM, XDR telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Indicator Removal activity. These methods apply across SIEM, XDR environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for Windows Event Log clearing events including Event ID 1102 (Security log cleared) and 1100 (Event logging service shutdown), as legitimate administrators rarely need to clear security logs during normal operations.

2. 2

   Alert on processes accessing and modifying or deleting files in Windows Event Log directories, Prefetch directories, and other forensic artifact storage locations outside of normal administrative tools.

3. 3

   Detect execution of commands designed to clear bash history on Unix systems including history -c, unset HISTFILE, and modification of .bash_history files, particularly on servers accessed by multiple users.

4. 4

   Monitor for timestomping activity using filesystem audit logs and file integrity monitoring, alerting on file modification times that predate the file system or that match known malware activity patterns.

5. 5

   Correlate gaps in log data with other security events to identify periods where logging may have been disabled or logs deleted, using log volume baselines to detect unexplained reductions in log generation rates.

Example Alerts

These realistic alert examples show what Indicator Removal looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Indicator Removal?

SOC analysts detect Indicator Removal (T1070) by monitoring SIEM, XDR telemetry for behavioral anomalies and specific indicators. Key detection methods include monitor for windows event log clearing events including event id 1102 (security log cleared) and 1100 (event logging service shutdown), as legitimate . SOCSimulator provides hands-on practice detecting this technique with realistic alerts.

What security tools are used to detect Indicator Removal?

Indicator Removal can be detected using SIEM, XDR platforms. SIEM tools are particularly effective for this technique because they provide visibility into the defense evasion phase of the attack chain. SOCSimulator simulates all three tool types for hands-on training.

How common is Indicator Removal in real-world attacks?

Indicator Removal is a well-documented MITRE ATT&CK technique in the Defense Evasion tactic. It appears in threat intelligence reports from multiple security vendors and has been observed in campaigns by various threat actor groups. SOCSimulator includes realistic Indicator Removal scenarios based on documented attack patterns, helping analysts build detection intuition.

Can I practice detecting Indicator Removal for free?

Yes. SOCSimulator offers free forever access to training scenarios, including Defense Evasion techniques like Indicator Removal. You can investigate realistic alerts in guided Operations rooms, build detection skills with SIEM, XDR, and Firewall interfaces, and test yourself under pressure in Shift Mode. No credit card required.