T1070.004

Official Description

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well.(Citation: Microsoft SDelete July 2016) Examples of built-in [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) functions include <code>del</code> on Windows, <code>rm</code> or <code>unlink</code> on Linux and macOS, and `rm` on ESXi.

Tactics: Stealth
Platforms: ESXi, Linux, macOS, Windows
Parent Technique: T1070 · Indicator Removal
MITRE Version: 2.0
Last Modified: May 12, 2026

View on MITRE ATT&CK ↗

Reported Context (5)

Observed DonutLoader runs deleted the cached shellcode container, Prefetch entries and contents of %TEMP%. CIS Links SLTT Remus C2 Traffic to Three Malware Delivery Chains
The macOS installation process deleted temporary files after executing the downloaded script. JSCEAL Malware Spread Through Fake Cryptocurrency Exchange Ads on Facebook
The loader and web shell deleted payload chunks and loader files after loading, and the web shell removed exploit-related lines from server.log. PaperCut Zero-Days Used to Deploy AdaptixC2 and Compromise an Education Customer’s Domain
The automated exploit framework attempted to remove selected traces from the Gitea database after exploitation. Red Heron Exploits Gitea CVE-2026-60004 in Multinational Campaign, Deploys Linux Rootkit
After creating the scheduled task, the dropper self-deletes. Analysis Finds .NET RAT Using Google Sheets C2 in UAE–India-Themed ISO

CVE (3)

Malware (8)

Threat Actors (4)

MITRE ATT&CK (43)

Vendors (4)

Products (24)

Tools (19)

Industries (11)

Countries (9)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.