Indicator Removal

What is Indicator Removal?

“Indicator Removal is documented as technique T1070 in MITRE ATT&CK® v19.1 under the Defense Evasion tactic. Detection requires visibility into SIEM, XDR telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Indicator Removal activity. These methods apply across SIEM, XDR environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for Windows Event Log clearing events including Event ID 1102 (Security log cleared) and 1100 (Event logging service shutdown), as legitimate administrators rarely need to clear security logs during normal operations.

2. 2

   Alert on processes accessing and modifying or deleting files in Windows Event Log directories, Prefetch directories, and other forensic artifact storage locations outside of normal administrative tools.

3. 3

   Detect execution of commands designed to clear bash history on Unix systems including history -c, unset HISTFILE, and modification of .bash_history files, particularly on servers accessed by multiple users.

4. 4

   Monitor for timestomping activity using filesystem audit logs and file integrity monitoring, alerting on file modification times that predate the file system or that match known malware activity patterns.

5. 5

   Correlate gaps in log data with other security events to identify periods where logging may have been disabled or logs deleted, using log volume baselines to detect unexplained reductions in log generation rates.

Example Alerts

These realistic alert examples show what Indicator Removal looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Indicator Removal?

Detection centers on SIEM, XDR telemetry for the defense evasion phase of the attack. Monitor for Windows Event Log clearing events including Event ID 1102 (Security log cleared) and 1100 (Event logging service shutdown), as legitimate administrators rarely need to clear security logs during normal operations. Alert on processes accessing and modifying or deleting files in Windows Event Log directories, Prefetch directories, and other forensic artifact storage locations outside of normal administrative tools.

What does a Indicator Removal alert look like?

A representative SIEM detection is "Windows Security Event Log Cleared" (critical severity): Event ID 1102 recorded on domain controller DC-01: Security audit log was cleared. The log clearing was performed by account DA_temp which was created 48 hours prior during a suspected compromise. Log entries prior to this clearance are no longer available, hampering forensic investigation of the intrusion timeline and eliminating evidence of lateral movement activity.

Which tools detect Indicator Removal, and how can I practice?

Indicator Removal (T1070) is best surfaced with SIEM, XDR telemetry, which exposes the defense evasion signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.