T1070 - Indicator Removal On Host is a MITRE ATT&CK technique where adversaries delete or alter artifacts on a compromised host (such as logs or other telemetry) to hinder detection.
Overview
T1070 - Indicator Removal On Host is a MITRE ATT&CK technique where adversaries delete or alter artifacts on a compromised host (such as logs or other telemetry) to hinder detection. The referenced incident involving a rogue techie highlights real-world insider threats and the potential for attackers to erase traces to avoid attribution, underscoring the importance of robust logging integrity and monitoring to detect such behavior.
Related Threat Clusters
-
Former IT Contractor Pleads Guilty to Hacking and Sabotage After Termination
Maxwell Schultz, a 35-year-old IT contractor from Ohio, pleaded guilty to computer fraud after hacking into his former employer's network in retaliation for his termination. He impersonated another contractor to gain…
3 articles · Updated November 20, 2025 -
Former Contractor Pleads Guilty to $862K Cyber Sabotage After Termination
Maxwell Schultz, a 35-year-old IT contractor from Ohio, pleaded guilty to hacking his former employer's network, causing approximately $862,000 in damages. After being terminated on May 14, 2021, Schultz impersonated…
3 articles · Updated November 20, 2025
Recent Intelligence Reports
- Rogue techie pleads guilty in $862K employer attack — Theregister · November 20, 2025