Technique T1070
Indicator Removal
Detection & mitigation
Monitor for consistent behavioral patterns (e.g., C2 beaconing, unusual process execution) rather than relying solely on domain indicators. Use endpoint telemetry to detect suspicious processes and network connections, and employ threat intelligence to identify related infrastructure.