Indicator removal is the practice of deleting or altering evidence that a system was compromised. Attackers may clear event logs, delete dropped files, wipe command histories, remove scheduled tasks, or tamper with registry entries and audit trails. The goal is to make incident response harder by hiding what happened, when it happened, and which tools were used.
In cyber security, indicator removal matters because defenders rely on artifacts to reconstruct an attack and scope the damage. It often appears after initial access, once an intruder has run commands, staged payloads, or exfiltrated data. Defenses focus on centralized logging, immutable or write-once log storage, alerting on log-clearing actions, and monitoring for unusual cleanup behavior on endpoints. Even when evidence is erased locally, security teams can often recover the story from network telemetry, backups, and host sensors.