Technique T1070

Indicator Removal

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE

Indicator Removal (T1070) — a Defense Evasion technique, observed in public incident reporting.

MITRE ATT&CKT1070

TacticDefense Evasion

Incidents on file12

Detection & mitigation

Monitor for abnormal disk usage patterns, especially sudden creation of large files in Defender's update directories or system temp folders. Alert on repeated Defender update failures and low disk space conditions. Implement disk quotas and monitor file creation events via Sysmon or EDR telemetry.

Observed in the wild

2026-09-21

indicator removal
BigDiskBuster PoC Disrupts Microsoft Defender Updates via Disk Space Exhaustion

2026-09-09

indicator removal
ClearFake Malware Campaign Delivers ZigCryptoStealer

2026-08-25

indicator removal
E4del and PINHOLE RATs Use FTP Banners as Dead Drops for C2

2026-08-18

indicator removal
Microsoft uncovers MacSync Stealer infrastructure via behavioral pivots

2026-08-14

indicator removal
HACKERAI Malware Uses GitHub Gists for C2

2026-08-05

indicator removal
7-Zip Default Setting Allows Extracted Files to Bypass Windows SmartScreen

2026-03-17

indicator removal
Researchers Decrypt Palo Alto Cortex XDR BIOC Rules, Uncover Global Whitelist Evasion

2025-11-13

indicator removal
Process Argument Spoofing via TLS Callbacks Evades EDR Detection

2025-11-13

indicator removal
Registry Tradecraft Evasion Using RegRestoreKey

2025-02-04

indicator removal
Null Routing Technique Silences EDR Communications

2024-04-22

indicator removal
Microsoft Defender and Kaspersky EDR File Deletion Vulnerabilities Disclosed

2023-08-11

indicator removal
Researchers Uncover Remote File Deletion Vulnerabilities in Multiple EDR Products

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →