T1070
Indicator Removal
Index entry
In-depth coverage of this technique (how it looks in telemetry, how to hunt it, and how to rule out benign activity) is coming soon. It's in our catalog and on the roadmap to be written up.
Telemetry needed
The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.
- Docker daemon events and API (the log as a whole)
- ESXi and vCenter logs (the log as a whole)
- Linux audit framework (auditd)
- SYSCALL:open SYSCALL record for open
- SYSCALL:rename SYSCALL record for rename
- SYSCALL:unlink SYSCALL record for unlink
- eBPF tracing (Tracee, Tetragon, Falco) (the log as a whole)
- Other Linux sources (procfs, FIM, package logs, shell history) (the log as a whole)
- Microsoft 365 Unified Audit Log
- osquery (macOS) (the log as a whole)
- Other macOS sources (fsevents, plists, launchd, TCC, MDM) (the log as a whole)
- macOS unified log (the log as a whole)
- Windows Security event log
- 1102 The audit log was cleared.
- Sysmon