safemode.space
← MITRE ATT&CK ICS
T0872

Indicator Removal on Host

Description

Adversaries may attempt to remove indicators of their presence on a system in an effort to cover their tracks. In cases where an adversary may feel detection is imminent, they may try to overwrite, delete, or cover up changes they have made to the device.

Mapped SPARTA techniques

2 techniques

  • DE-0003.08Received CommandsST0006
    addresses
    high

    Manipulating received-command history (deleting entries, altering timestamps) is exactly T0872 'Indicator Removal on Host' applied to the spacecraft's command-log audit trail. Tactic and activity align.

  • DE-0010Overflow Audit LogST0006
    addresses
    high

    Overflowing the audit log to evict adversary-evidence entries is a direct instance of T0872 'Indicator Removal on Host' — by causing log rollover, the adversary effectively removes the indicator records that would document their activity. Tactic and activity align directly.

Cite as SafeMode Space, mitre-attack-ics T0872.

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.