Clear Log/Command History
Parent: T1070
Description
If a log is available, an attacker can delete logging onboard the spacecraft to hide illegitimate operations (a TC log service is usually not implemented). (Citation: MITRE ATT&CK)
Mapped SPARTA techniques
3 techniques
T1070.001 'Clear Log/Command History' explicitly covers deleting onboard logging to hide illegitimate operations — direct match to DE-0003.08's editing/pruning of command-history buffers, logs, and event records.
T1070.001 'Clear Log/Command History' covers the log-clearing subset of rootkit evasion (filtering telemetry packets, rewriting recorder catalogs, biasing housekeeping).
T1070.001 'Clear Log/Command History' is the direct cross-framework counterpart for log overflow — both describe overwriting onboard logging to hide illegitimate operations (DE-0010 achieves this via buffer exhaustion rather than direct deletion).
Cite as SafeMode Space, space-shield T1070.001.