メニュー
Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1070-indicator-removalコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
SOC 職業分類に基づく
SKILL.md を表示中
| name | T1070_indicator-removal |
| description | Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. |
| category | configuration |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1070","defense-evasion","containers","esxi","linux","macos","network-devices","office-suite","windows"] |
| technique_id | T1070 |
| tactic | defense-evasion |
| all_tactics | ["defense-evasion"] |
| platforms | ["Containers","ESXi","Linux","macOS","Network Devices","Office Suite","Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1070 |
| tech_stack | ["containers","esxi","linux","macos","network devices","office","windows"] |
| cwe_ids | ["CWE-693"] |
| chains_with | ["T1070.001","T1070.002","T1070.003","T1070.004","T1070.005","T1070.006","T1070.007","T1070.008","T1070.009","T1070.010"] |
| prerequisites | [] |
| severity_boost | {"T1070.001":"Chain with T1070.001 for deeper attack path","T1070.002":"Chain with T1070.002 for deeper attack path","T1070.003":"Chain with T1070.003 for deeper attack path"} |
Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity. This may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.
Platforms: Containers, ESXi, Linux, macOS, Network Devices, Office Suite, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Manages the update sequence number (USN) change journal, which provides a persistent log of all changes made to files on the volume. Upon execution, no output will be displayed. More information about fsutil can be found at https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn
Supported Platforms: windows Elevation Required: Yes
fsutil usn deletejournal /D C:
Finds a file by user name (if Disk Quotas are enabled), queries allocated ranges for a file, sets a file's short name, sets a file's valid data length, sets zero data for a file, or creates a new file. Upon execution, no output will be displayed. More information about fsutil can be found at https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file
Supported Platforms: windows
if (-not (Test-Path "#{file_to_manipulate}")) { New-Item "#{file_to_manipulate}" -Force }
echo "1234567890" > "#{file_to_manipulate}"
fsutil file setZeroData offset=0 length=#{file_data_length} "#{file_to_manipulate}"
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Indicator Removal by examining the target platforms (Containers, ESXi, Linux).
Assess Existing Defenses: Review whether mitigations for T1070 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.
Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.
Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.
| Finding | Severity | Impact |
|---|---|---|
| Indicator Removal technique applicable | Low | Defense Evasion |
| CWE ID | Title |
|---|---|
| CWE-693 | Protection Mechanism Failure |