Skip to content

T1070 - Indicator Removal On Host

MITRE ATT&CK

Threat entity extracted from intelligence sources

Frequency
1
occurrences
First Seen
November 20, 2025
Last Seen
November 20, 2025
API

T1070 - Indicator Removal On Host is a MITRE ATT&CK technique where adversaries delete or alter artifacts on a compromised host (such as logs or other telemetry) to hinder detection.

Overview

Recent Events

Profile

1 / 2

Tools Used

PowerShell

Regions

North Korea

Relationships

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Related Entities

Data BreachWaste ManagementNorth KoreaT1059.001 - PowerShellT1059 - Command and Scripting InterpreterT1070.001 - Clear Windows Event LogsT1078 - Valid AccountsPowerShell