T0872 Indicator Removal on Host
ICSAdversaries may attempt to remove indicators of their presence on a system in an effort to cover their tracks. In cases where an adversary may feel detection is imminent, they may try to overwrite, delete, or cover up changes they have made to the device.
01
platforms
Platforms this applies to.
EmbeddedWindowsLinuxNetwork Devices
02
mitigations
ATT&CK mitigations that reduce this.
03
detected by (5)
Data components that detect this.
04
software (2)
Malware and tools associated with this.
05
targets assets (16)
ICS/OT assets this targets.
06
campaigns (1)
Campaigns that use this.
07
source
Where this definition is published.