Indicator Removal on Host

Removing selected artifacts of malicious activity to impede detection or forensic reconstruction. Examples include terminating a running malicious process, clearing a selected Windows event log, or deleting a malicious or staged file. These are separate actions chosen for the artifact present, not a required sequence. A cleared log or deleted file may still be detectable or recoverable through retained telemetry and forensic analysis.