← Back to ATT&CK index
T1070.004sub-technique
Indicator Removal: File Deletion
View on attack.mitre.org →3 syscalls implement this technique
- NtDeleteObjectAuditAlarm
Emits the Security event-log entry that records the deletion of an audited object.
- NtDeleteFile
Deletes a file by path without first opening a handle — a rare anti-forensics primitive.
- NtSetInformationFile
Sets file metadata via FILE_INFORMATION_CLASS — rename, dispose (delete), allocate, end-of-file, etc.