T1070.004: File Deletion
AI Answer
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, (Source: MITRE ATT&CK T1070.004)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1070.004 |
| Name | File Deletion |
| Tactic | stealth (stealth) |
| Platforms | ESXi, Linux, macOS, Windows |
| Sub-technique | Yes |
Why it matters
In the OpenTrojan knowledge graph, File Deletion (T1070.004) is one of the highest-connectivity ATT&CK techniques: 311 MITRE STIX relationships reference this technique; 47 threat groups observed using it; 251 software families associated; 13 campaigns associated. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1070.004).
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary’s footprint. There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well. Examples of built-in Command and Scripting Interpreter functions include del on Windows, rm or unlink on Linux and macOS, and rm on ESXi.
Detection
Not available — MITRE ATT&CK does not currently publish a structured detection strategy for this technique in the ingested dataset.
Mitigation
Not available — no MITRE course-of-action was found for this technique in the ingested dataset.
Related Software
- PowerDuke
- BLINDINGCAN
- RCSession
- Bumblebee
- BRICKSTORM
- MURKYTOP
- RDFSNIFFER
- NICECURL
- Proxysvc
- NOKKI
- Backdoor.Oldrea
- Stuxnet
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Threat Groups
- APT38
- BlackByte
- APT3
- Kimsuky
- Volt Typhoon
- Patchwork
- APT41
- Dragonfly
- Evilnum
- menuPass
- APT32
- FIN6
Group associations are from MITRE ATT&CK STIX relationships.
Related Campaigns
- Operation Dream Job
- KV Botnet Activity
- RedPenguin
- Operation Honeybee
- 2015 Ukraine Electric Power Attack
- Cutting Edge
- Operation Digital Eye
- C0032
- SolarWinds Compromise
- Operation AkaiRyū
- ArcaneDoor
- APT41 DUST
Campaign associations are from MITRE ATT&CK STIX relationships.
References
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1070.004 File Deletion. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1070.004 File Deletion?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.