Skip to content

Indicator Removal

Technique · ATTACK:enterprise:T1070

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1070",
  "title": "Indicator Removal",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1070",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--799ace7f-e227-4411-baa0-8868704f2a69",
  "external_id": "T1070",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:55.892Z",
  "modified": "2026-05-12T15:12:00.643Z",
  "version": "3.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [

  ]
}

Explicit source assertions (44)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1132 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--038940df-ae44-4ca6-a417-6e4aac6a2f56

SentinelOne Agrius 2021

ATTACK:enterprise:T1070.004 → subtechnique-of → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05e3980c-03ae-4624-82d8-0cbcc45705cd

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07f86f87-71bf-4f6b-b902-e6e4d912e2d6

ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08f4dfcb-c394-470d-851f-045bbc38cdb5

Proofpoint TA505 October 2019

ATTACK:enterprise:T1070.006 → subtechnique-of → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d06a9f1-fc35-4f35-a628-3515b0686747

ATTACK:enterprise:S1161 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d76add8-c0f1-44e3-abf2-f6063c43a100

Sandfly BPFDoor 2022

ATTACK:enterprise:S0596 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0dff1232-e275-46bd-b893-3df8b5a6b0c2

Kaspersky ShadowPad Aug 2017

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12c761e7-f026-4e14-80fb-da9f4cb0ca38

F-Secure BlackEnergy 2014

ATTACK:enterprise:M1041 → mitigates → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--185c194a-5823-46e4-9719-9de48c3c1734

ATTACK:enterprise:S0568 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2062ec61-e6b5-45dd-8d2d-71aa5aa1f6e8

Prevailion EvilNum May 2020

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2123bedd-f2b3-4856-9ee4-5d23aa9c8745

GitHub SILENTTRINITY Modules July 2019

ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25c038d5-7cba-4416-ac10-f1c893942042

Mandiant Cutting Edge Part 2 January 2024 · Volexity Ivanti Zero-Day Exploitation January 2024

ATTACK:enterprise:S1135 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27e8b9dc-9b72-4e69-b093-c80c81cf6d59

Unit42 Agrius 2023

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3022f4d3-c2b9-4937-96ae-f4d86ba89bb8

Mandiant APT42-untangling

ATTACK:enterprise:S0229 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31501f0f-e5be-4980-a2f1-b241d68f654c

Proofpoint Leviathan Oct 2017

ATTACK:enterprise:S1159 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a065510-e719-4048-aec2-99db1cae1f79

Google Cloud APT41 2024

ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42d6cd7c-a512-4fb9-a625-d21152b60f22

ESET Hermetic Wizard March 2022 · Crowdstrike DriveSlayer February 2022

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49697cc6-d5fe-4a93-afbc-7eb767056021

Eset PlugX Korplug Mustang Panda March 2022

ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5246b52e-cb6c-43da-84e5-dff0172abaea

FireEye Metamorfo Apr 2018

ATTACK:enterprise:T1070.008 → subtechnique-of → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5f69f13e-c7e7-488f-8e5e-988ab41a2a39

ATTACK:enterprise:M1029 → mitigates → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60151204-5c0c-4d18-8582-4d0fad22ed08

ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6db4729b-596c-43c1-81f4-d374a2f2e06b

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--726e2014-a0d6-4ed3-959b-2ad647884f5c

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:S0448 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--811ba10b-6fe7-40d9-ab98-70d4135ac7cf

McAfee Sharpshooter December 2018

ATTACK:enterprise:T1070.009 → subtechnique-of → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82ea5e2c-b5c2-467c-a7ec-bad7a38b743e

ATTACK:enterprise:T1070.003 → subtechnique-of → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a31e4c9c-c69d-445e-a669-0b0f6bdaff3e

ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4d00569-50d8-4571-9ea8-3cafcfbfaacb

Mandiant Pulse Secure Zero-Day April 2021 · Mandiant Pulse Secure Update May 2021

ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a9154086-7359-4e2b-b70f-edcde2d43a80

Fortinet Remcos Campaign NOV 2024

ATTACK:enterprise:S1044 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b26f9867-37f2-4b7f-9b87-26f2152191bc

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:S1085 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb5486b6-f5b3-4a4c-9b88-d676011a4906

Bitdefender Sardonic Aug 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bbc492bf-de7c-4ef7-ba1b-565ec0f22379

FireEye SUNBURST Backdoor December 2020

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bcee230a-c671-4c71-afbf-d6216aeee5b6

Lazarus APT January 2022

ATTACK:enterprise:T1070.010 → subtechnique-of → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c3292719-cc3d-4f3f-9f8a-92dda3c0c72c

ATTACK:enterprise:T1070.007 → subtechnique-of → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c3499466-50f5-45fb-9fc0-14030e01822f

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cabbe975-9936-4a9a-8fae-a747b3dc7a9d

McAfee Maze March 2020

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8b95918-bf5b-455a-928c-1b69fe9c9703

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:S0527 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--df1cdf5d-aaca-4a6f-ac5f-2506df830f62

Cybereason Kimsuky November 2020

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--df520c15-50fc-46cf-8559-368e88072aa7

US-CERT Bankshot Dec 2017

ATTACK:enterprise:S9029 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e1947d14-2a8a-4f22-90dd-75a351c039bd

Check Point Wirte NOV 2024

ATTACK:enterprise:S0696 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2d28250-862e-4dd5-8712-aa6b6782b088

NTT Security Flagpro new December 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f54e5455-c539-4bcb-9a06-92440314324f

Prevailion DarkWatchman 2021

ATTACK:enterprise:T1070.005 → subtechnique-of → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fcfa67b5-03dc-4d92-bc34-0f483d48bc6a

ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fed38133-26a9-44e3-b57d-9d415aaeaf84

Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:S0691 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fee1306e-0a56-40c0-b3ea-ff0697c464a4

Microsoft NICKEL December 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.