T1070Defense Evasion

Indicator Removal

Delete or modify logs and artifacts to hide activity.

§ Where this technique fits

T1070 is catalogued under the Defense Evasion tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 6 on average.

Authoritative reference: attack.mitre.org/techniques/T1070/.

§ Dossiers chaining this technique

Cloudflare account compromise → Worker rewrite → mass cred theft
Phish a Cloudflare account belonging to a popular site operator. Deploy a Worker that injects JS into every response — captures form posts (logins, payments) for the duration the operator doesn't notice.
step 6 / 6

§ Where this technique fits

§ Dossiers chaining this technique

Cloudflare account compromise → Worker rewrite → mass cred theft