attack_technique: T1070
display_name: Indicator Removal on Host
atomic_tests:
- name: Indicator Removal using FSUtil
  auto_generated_guid: b4115c7a-0e92-47f0-a61e-17e7218b2435
  description: |
    Manages the update sequence number (USN) change journal, which provides a persistent log of all changes made to files on the volume. Upon execution, no output
    will be displayed. More information about fsutil can be found at https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn
  supported_platforms:
  - windows
  executor:
    command: |
      fsutil usn deletejournal /D C:
    cleanup_command: |
      fsutil usn createjournal m=1000 a=100 c:
    name: command_prompt
    elevation_required: true
