Which SIEM platforms have a T1070 detection rule?

df00tech provides T1070 (Indicator Removal) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Indicator Removal (T1070)?

Detecting Indicator Removal requires the following data sources: Windows Registry: Windows Registry Key Deletion, Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint.

What severity and confidence is the T1070 detection?

The T1070 detection is rated high severity with medium confidence.

What are common false positives for T1070?

Common false positives for T1070 include: Software uninstallers that legitimately remove their own registry run keys and service entries during clean uninstallation; IT management tools (SCCM, Intune, Group Policy) that delete temporary registry values as part of deployment or policy application; System cleanup utilities (CCleaner, Windows Disk Cleanup) that remove cached artifacts and registry entries as part of routine maintenance.

T1070 IBM QRadar · QRadar

Detect Indicator Removal in IBM QRadar

Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary's actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity. This may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.

MITRE ATT&CK

Tactic: Defense Evasion
Technique: T1070 Indicator Removal
Canonical reference: https://attack.mitre.org/techniques/T1070/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(startTime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  QIDNAME(qid) AS event_name,
  "RegistryPath" AS registry_path,
  "CommandLine" AS command_line,
  "Image" AS process_image,
  "ParentImage" AS parent_process,
  CATEGORYNAME(category) AS category_name,
  CASE
    WHEN "RegistryPath" LIKE '%\Run\%'
      OR "RegistryPath" LIKE '%\RunOnce\%'
      OR "RegistryPath" LIKE '%\Services\%'
      OR "RegistryPath" LIKE '%Scheduled Tasks%'
      OR "RegistryPath" LIKE '%AppInit_DLLs%'
      OR "RegistryPath" LIKE '%NetworkProvider\Order%'
      OR "RegistryPath" LIKE '%Image File Execution%'
      OR "RegistryPath" LIKE '%TESTSIGNING%'
    THEN 'registry_key_deletion_persistence'
    WHEN LOWER("CommandLine") LIKE '%reg delete%'
      OR LOWER("CommandLine") LIKE '%reg.exe delete%'
      OR LOWER("CommandLine") LIKE '%remove-itemproperty%'
      OR LOWER("CommandLine") LIKE '%remove-item%hklm%'
      OR LOWER("CommandLine") LIKE '%remove-item%hkcu%'
    THEN 'registry_delete_command'
    WHEN LOWER("CommandLine") LIKE '%cmd /c del%'
      OR LOWER("CommandLine") LIKE '%cmd.exe /c del%'
      OR LOWER("CommandLine") LIKE '%del /f%'
      OR LOWER("CommandLine") LIKE '%erase /f%'
    THEN 'self_deletion_pattern'
    ELSE 'indicator_removal_activity'
  END AS detection_reason,
  CASE
    WHEN "EventID" = '12' OR "EventID" = '14' THEN 'RegistryKeyDeleted'
    WHEN "EventID" = '1' OR "EventID" = '4688' THEN 'ProcessCreation'
    ELSE 'Other'
  END AS event_type
FROM events
WHERE
  startTime > NOW() - 86400000
  AND (
    (
      "EventID" IN ('12', '14')
      AND (
        "RegistryPath" LIKE '%\Run\%'
        OR "RegistryPath" LIKE '%\RunOnce\%'
        OR "RegistryPath" LIKE '%\Services\%'
        OR "RegistryPath" LIKE '%Scheduled Tasks%'
        OR "RegistryPath" LIKE '%AppInit_DLLs%'
        OR "RegistryPath" LIKE '%NetworkProvider\Order%'
        OR "RegistryPath" LIKE '%Image File Execution%'
        OR "RegistryPath" LIKE '%TESTSIGNING%'
      )
    )
    OR (
      "EventID" IN ('1', '4688')
      AND (
        LOWER("CommandLine") LIKE '%reg delete%'
        OR LOWER("CommandLine") LIKE '%reg.exe delete%'
        OR LOWER("CommandLine") LIKE '%remove-itemproperty%'
        OR LOWER("CommandLine") LIKE '%remove-item%hklm%'
        OR LOWER("CommandLine") LIKE '%remove-item%hkcu%'
        OR LOWER("CommandLine") LIKE '%cmd /c del%'
        OR LOWER("CommandLine") LIKE '%cmd.exe /c del%'
        OR LOWER("CommandLine") LIKE '%del /f%'
        OR LOWER("CommandLine") LIKE '%erase /f%'
      )
    )
  )
ORDER BY startTime DESC

high severity medium confidence

Detects T1070 Indicator Removal in QRadar AQL by correlating Sysmon registry events (EventID 12 and 14 for key creation/deletion and key rename) with process creation events (Sysmon EventID 1 and Security EventID 4688). Applies CASE-based classification to distinguish registry persistence path deletions from command-line driven registry cleanup and self-deletion patterns. Results ordered by recency for analyst triage.

Data Sources

IBM QRadar DSM for Microsoft WindowsSysmon Universal DSMMicrosoft Windows Security Event Log DSM

Required Tables

events

False Positives & Tuning

Software package managers and Windows Installer removing application-specific registry persistence entries during sanctioned uninstall operations
Group Policy and endpoint management platforms (SCCM, Intune) deleting or replacing registry configuration keys during policy enforcement cycles
Security hardening automation scripts executing reg delete commands to remove legacy or insecure registry entries per CIS or DISA STIG benchmarks

Download portable Sigma rule (.yml)

Other platforms for T1070

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Registry Key Self-Cleanup — Delete Run Key
Expected signal: Sysmon Event ID 12 (RegistryEvent - Object Create/Delete): TargetObject=HKCU\Software\Microsoft\Windows\CurrentVersion\Run\df00tech-test, EventType=DeleteValue. Sysmon Event ID 1: two cmd/reg.exe process creation events. Security Event ID 4657 (if object access auditing is enabled): ObjectName matching the Run key path.
Test 2Executable Self-Deletion via cmd.exe
Expected signal: Sysmon Event ID 1: Process creation for df00tech-cleanup-test.exe. Sysmon Event ID 1: cmd.exe with CommandLine containing 'del /f /q' and the .exe path. Sysmon Event ID 11: file create for df00tech-cleanup-test.exe. Sysmon Event ID 23 (if configured): FileDelete event for df00tech-cleanup-test.exe showing the file was archived by Sysmon before deletion.
Test 3PowerShell Registry Key Deletion
Expected signal: Sysmon Event ID 12 (RegistryEvent - Create/Delete): EventType=DeleteKey, TargetObject=HKCU\Software\Microsoft\Internet Explorer\notes. Sysmon Event ID 1: powershell.exe with CommandLine containing 'Remove-Item' and 'Internet Explorer\notes'. PowerShell ScriptBlock Log Event ID 4104 with full script content showing the create and delete sequence.
Test 4Drop-Execute-Delete Pattern in Temp Directory
Expected signal: Sysmon Event ID 11: file creation of svcupdate32.exe in C:\Users\Public\. Sysmon Event ID 1: execution of svcupdate32.exe. Sysmon Event ID 1: cmd.exe with del command. Sysmon Event ID 23 (FileDelete, if configured): svcupdate32.exe deletion. KQL hunting query matches execution in Public directory followed by file deletion within 60 minutes.
Test 5Simulate BPFDoor Environment Variable Clearing
Expected signal: Auditd syscall event for open(2) with flags O_WRONLY on /proc/<PID>/environ path. Syslog entry if auditd is configured to watch /proc/*/environ with inode watches. Linux audit event type=PATH with name matching /proc/[0-9]+/environ.

Last updated: 2026-04-13 Research depth: deep

References (12)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1070 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Related Detections

Sub-techniques (10)

Related Techniques

T1070.001Clear Windows Event Logs T1070.002Clear Linux or Mac System Logs T1070.003Clear Command History T1070.004File Deletion T1070.005Network Share Connection Removal T1070.006Timestomp T1070.007Clear Network Connection History and Configurations T1070.008Clear Mailbox Data T1070.009Clear Persistence T1070.010Relocate Malware T1562.001Disable or Modify Tools T1112Modify Registry T1485Data Destruction T1003OS Credential Dumping

Detect Indicator Removal in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1070

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Sub-techniques (10)

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1070

Testing Methodology

Unlock Pro Content

Related Detections

Sub-techniques (10)

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

Get new detections in your inbox