CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE
Indicator Removal (T1070) — a Defense Evasion technique, observed in public incident reporting.
MITRE ATT&CKT1070
TacticDefense Evasion
Incidents on file15
Detection & mitigation
Monitor for unusual USB device activity, unexpected firmware changes, or anomalous data transfers to peripherals. Implement device control policies and consider EDR solutions that extend visibility to peripheral devices.