attack.t1070

Clearing Windows Console History

Apr 28, 2026 · attack.stealth attack.t1070 attack.t1070.003 ·

Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

Disable of ETW Trace - Powershell

Apr 28, 2026 · attack.stealth attack.defense-impairment attack.t1070 attack.t1685 car.2016-04-002 ·

Share on:

Detects usage of powershell cmdlets to disable or remove ETW trace sessions

DLL Load By System Process From Suspicious Locations

Apr 28, 2026 · attack.stealth attack.t1070 ·

Share on:

Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as "C:\Users\Public"

ETW Trace Evasion Activity

Apr 28, 2026 · attack.stealth attack.defense-impairment attack.t1070 attack.t1685 car.2016-04-002 ·

Share on:

Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.

EventLog EVTX File Deleted

Apr 28, 2026 · attack.stealth attack.t1070 ·

Share on:

Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence

Exchange PowerShell Cmdlet History Deleted

Apr 28, 2026 · attack.stealth attack.t1070 ·

Share on:

Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence

Filter Driver Unloaded Via Fltmc.EXE

Apr 28, 2026 · attack.stealth attack.defense-impairment attack.t1070 attack.t1685 attack.t1685.001 ·

Share on:

Detect filter driver unloading activity via fltmc.exe

Fsutil Suspicious Invocation

Apr 28, 2026 · attack.impact attack.stealth attack.t1070 attack.t1485 ·

Share on:

Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others).

IIS WebServer Access Logs Deleted

Apr 28, 2026 · attack.stealth attack.t1070 ·

Share on:

Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence

IIS WebServer Log Deletion via CommandLine Utilities

Apr 28, 2026 · attack.stealth attack.t1070 ·

Share on:

Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks. Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.

Kubernetes Events Deleted

Apr 28, 2026 · attack.stealth attack.t1070 ·

Share on:

Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detection.

Linux Package Uninstall

Apr 28, 2026 · attack.stealth attack.t1070 ·

Share on:

Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg".

Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE

Apr 28, 2026 · attack.stealth attack.t1070 attack.persistence attack.t1542.003 ·

Share on:

Detects potential malicious and unauthorized usage of bcdedit.exe

PowerShell Console History Logs Deleted

Apr 28, 2026 · attack.stealth attack.t1070 ·

Share on:

Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence

Remove Exported Mailbox from Exchange Webserver

Apr 28, 2026 · attack.stealth attack.t1070 ·

Share on:

Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit

SES Identity Has Been Deleted

Apr 28, 2026 · attack.stealth attack.t1070 ·

Share on:

Detects an instance of an SES identity being deleted via the "DeleteIdentity" event. This may be an indicator of an adversary removing the account that carried out suspicious or malicious activities