# T1070 - Indicator Removal on Host
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1070)
<blockquote>Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as [Bash History](https://attack.mitre.org/techniques/T1552/003) and /var/log/*.

These actions may interfere with event collection, reporting, or other notifications used to detect intrusion activity. This that may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.</blockquote>

## Atomic Tests

- [Atomic Test #1 - Indicator Removal using FSUtil](#atomic-test-1---indicator-removal-using-fsutil)


<br/>

## Atomic Test #1 - Indicator Removal using FSUtil
Manages the update sequence number (USN) change journal, which provides a persistent log of all changes made to files on the volume. Upon execution, no output
will be displayed. More information about fsutil can be found at https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn

**Supported Platforms:** Windows


**auto_generated_guid:** b4115c7a-0e92-47f0-a61e-17e7218b2435






#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
fsutil usn deletejournal /D C:
```

#### Cleanup Commands:
```cmd
fsutil usn createjournal m=1000 a=100 c:
```





<br/>
