# T1070.003 Clear Command History > As of 2026-10-05, T1070.003 (Clear Command History) appears in 21 tracked threats, first reported 2026-02-24 and most recently 2026-09-23, with linked actors including APT38, Andariel, Lazarus Group; it most often appears alongside T1082 (System Information Discovery). - **Tracked threats:** 21 (8 critical, 12 high, 1 medium) - **First seen:** 2026-02-24 - **Last seen:** 2026-09-23 - **Threat actors:** 12 - **Detection rules:** 32 (counts only; Blue tier and above) ## Key facts - **ID:** T1070.003 - **Framework:** MITRE ATT&CK - **Tactics:** Stealth (formerly Defense Evasion) - **Matrix:** Enterprise - **Parent:** T1070 - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1070/003/ ## Activity timeline T1070.003 first appeared in tracked threats on 2026-02-24 and was most recently reported on 2026-09-23. The busiest month was 2026-07 with 8 reports, and 21 of the 21 threats were reported in the twelve months to 2026-09. ## How adversaries use it T1070.003 Clear Command History is catalogued by MITRE ATT&CK under the Stealth (formerly Defense Evasion) tactic in the Enterprise matrix, as a sub-technique of [T1070 Indicator Removal](https://intel.threadlinqs.com/technique/T1070). Threadlinqs maps 21 of 2623 tracked threats (0.8%) to it; by severity that is 8 critical, 12 high, 1 medium. Threats that use T1070.003 most often also use [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (15 threats), [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (14 threats), [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (14 threats), [T1059.004 Unix Shell](https://intel.threadlinqs.com/technique/T1059.004) (13 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (12 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 12 tracked threat actors appear in the threats that use T1070.003; the most frequent are [APT38](https://intel.threadlinqs.com/actor/APT38) (3), [Andariel](https://intel.threadlinqs.com/actor/Andariel) (2), [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) (2), [UAT-8616](https://intel.threadlinqs.com/actor/UAT-8616) (2), [INC Ransom](https://intel.threadlinqs.com/actor/INC%20Ransom) (1). ## Mitigations MITRE ATT&CK lists 3 mitigations for T1070.003. - [M1022 Restrict File and Directory Permissions](https://attack.mitre.org/mitigations/M1022/) - [M1029 Remote Data Storage](https://attack.mitre.org/mitigations/M1029/) - [M1039 Environment Variable Permissions](https://attack.mitre.org/mitigations/M1039/) ## Data sources Telemetry that can reveal T1070.003, per MITRE ATT&CK. - Command — Command Execution - File — File Deletion, File Modification - Process — Process Creation - User Account — User Account Authentication ## Threat actors using it - [APT38](https://intel.threadlinqs.com/actor/APT38) — 3 - [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 2 - [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) — 2 - [UAT-8616](https://intel.threadlinqs.com/actor/UAT-8616) — 2 - [INC Ransom](https://intel.threadlinqs.com/actor/INC%20Ransom) — 1 - [INC Ransom - G1032](https://intel.threadlinqs.com/actor/INC%20Ransom%20-%20G1032) — 1 - [Lynx](https://intel.threadlinqs.com/actor/Lynx) — 1 - [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) — 1 - [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) — 1 - [Static Tundra](https://intel.threadlinqs.com/actor/Static%20Tundra) — 1 - [Stonefly](https://intel.threadlinqs.com/actor/Stonefly) — 1 - [UNC1069](https://intel.threadlinqs.com/actor/UNC1069) — 1 ## Tracked threats 21 tracked threats use T1070.003. - [Macfinger ClickFix Campaign Delivers Atomic macOS Stealer (AMOS) via Fake Verification Prompts](https://intel.threadlinqs.com/threat/TL-2026-2622) — high — 2026-09-23 - [PowerShell Cryptomining Loader Abuses Registry-Resident Scripts, DNS TXT Records, and PNG/WAV Steganography…](https://intel.threadlinqs.com/threat/TL-2026-2593) — medium — 2026-09-20 - [Attacker Maintains Root-Level MeshCentral Backdoor Inside Thai ISP 3BB, Targets RADIUS Subscriber-Credential…](https://intel.threadlinqs.com/threat/TL-2026-2514) — high — 2026-09-15 - [DPRK-Linked APT37 (Medium Confidence) Deploys Novel 'Ted' HAProxy Backdoor and 'CurlRAT'-Trojanized Linux…](https://intel.threadlinqs.com/threat/TL-2026-2329) — high — 2026-09-04 - [Go-Based macOS Stealer Uses ClickFix Lures to Drain Cryptocurrency Wallets (Aeza Group Infrastructure)](https://intel.threadlinqs.com/threat/TL-2026-2066) — high — 2026-08-18 - [AmnesiaStealer: macOS Infostealer Hijacks Live Browser Sessions via Chrome DevTools Protocol Remote Control](https://intel.threadlinqs.com/threat/TL-2026-2029) — high — 2026-08-16 - [ClickFix Attack Delivers Go-Based macOS Infostealer Targeting Cryptocurrency Wallets and Credentials](https://intel.threadlinqs.com/threat/TL-2026-1920) — high — 2026-08-06 - [CVE-2026-59726 (RufRoot): Unauthenticated RCE in Ruflo MCP Bridge Poisons AI Agent Memory](https://intel.threadlinqs.com/threat/TL-2026-1762) — critical — 2026-07-29 - [CVE-2026-57309: Unauthenticated Blind SQL Injection in Windu CMS 4.1 (with CVE-2026-57310 Weak Password…](https://intel.threadlinqs.com/threat/TL-2026-1568) — high — 2026-07-20 - [COLDRIVER (UNC4057/Star Blizzard) Re-Tools with NOROBOT/BAITSWITCH/YESROBOT/MAYBEROBOT/SIMPLEFIX Malware…](https://intel.threadlinqs.com/threat/TL-2026-1510) — high — 2026-07-19 - [ACR Stealer (Amatera Stealer) Uses ClickFix Lures, WebDAV/pushd DLL Delivery, and EtherHiding to Harvest…](https://intel.threadlinqs.com/threat/TL-2026-1444) — high — 2026-07-17 - [NSA/FBI Joint Advisory: Disable Cisco Smart Install to Block Russian FSB "Static Tundra" Exploitation of…](https://intel.threadlinqs.com/threat/TL-2026-1279) — critical — 2026-07-13 - [FortiBleed: Mass Credential Compromise Campaign Against Internet-Exposed Fortinet FortiGate Devices (86,644…](https://intel.threadlinqs.com/threat/TL-2026-1232) — critical — 2026-07-11 - [CVE-2026-50746: Critical Unauthenticated Command Injection in Ubiquiti UniFi Connect Application (CVSS 10.0)](https://intel.threadlinqs.com/threat/TL-2026-1159) — critical — 2026-07-10 - [AI Compute Hijacking: Stolen Ollama Server Wired Into Autonomous "VAPT" Exploit Pipeline (Sysdig)](https://intel.threadlinqs.com/threat/TL-2026-1076) — high — 2026-07-02 - [Sapphire Sleet (DPRK) 'easy-day-js' Supply-Chain Compromise of 140+ Mastra npm Packages via Hijacked…](https://intel.threadlinqs.com/threat/TL-2026-0898) — critical — 2026-06-22 - [CVE-2026-54420 — LiteSpeed cPanel Plugin Symlink-Following (CWE-61) Privilege Escalation to Root on…](https://intel.threadlinqs.com/threat/TL-2026-0872) — high — 2026-06-19 - [Lazarus Group (DPRK) Hides BeaverTail / InvisibleFerret Loader in Git Hooks via precommit.vercel.app…](https://intel.threadlinqs.com/threat/TL-2026-0464) — high — 2026-05-06 - [CVE-2026-20127 Cisco Catalyst SD-WAN Zero-Day — UAT-8616 Authentication Bypass Active Exploitation](https://intel.threadlinqs.com/threat/TL-2026-0166) — critical — 2026-03-02 - [Cisco Catalyst SD-WAN Zero-Day (CVE-2026-20127) — UAT-8616 Active Exploitation Since 2023, Authentication…](https://intel.threadlinqs.com/threat/TL-2026-0145) — critical — 2026-02-26 - [Lazarus Group Medusa Ransomware — North Korean State-Backed Extortion Targeting US Healthcare and Middle East](https://intel.threadlinqs.com/threat/TL-2026-0140) — critical — 2026-02-24 ## Related CVEs CVEs referenced by the tracked threats that use T1070.003, most frequent first. - [CVE-2022-20775](https://intel.threadlinqs.com/cve/CVE-2022-20775) - [CVE-2024-21762](https://intel.threadlinqs.com/cve/CVE-2024-21762) - [CVE-2026-20127](https://intel.threadlinqs.com/cve/CVE-2026-20127) - [CVE-2016-5195](https://intel.threadlinqs.com/cve/CVE-2016-5195) - [CVE-2018-0171](https://intel.threadlinqs.com/cve/CVE-2018-0171) - [CVE-2018-13379](https://intel.threadlinqs.com/cve/CVE-2018-13379) - [CVE-2021-4034](https://intel.threadlinqs.com/cve/CVE-2021-4034) - [CVE-2022-40684](https://intel.threadlinqs.com/cve/CVE-2022-40684) - [CVE-2022-41328](https://intel.threadlinqs.com/cve/CVE-2022-41328) - [CVE-2022-42475](https://intel.threadlinqs.com/cve/CVE-2022-42475) - [CVE-2023-27997](https://intel.threadlinqs.com/cve/CVE-2023-27997) - [CVE-2023-48788](https://intel.threadlinqs.com/cve/CVE-2023-48788) - [CVE-2024-55591](https://intel.threadlinqs.com/cve/CVE-2024-55591) - [CVE-2025-59718](https://intel.threadlinqs.com/cve/CVE-2025-59718) - [CVE-2025-59719](https://intel.threadlinqs.com/cve/CVE-2025-59719) - [CVE-2025-68686](https://intel.threadlinqs.com/cve/CVE-2025-68686) - [CVE-2026-24858](https://intel.threadlinqs.com/cve/CVE-2026-24858) - [CVE-2026-34908](https://intel.threadlinqs.com/cve/CVE-2026-34908) - [CVE-2026-34909](https://intel.threadlinqs.com/cve/CVE-2026-34909) - [CVE-2026-34910](https://intel.threadlinqs.com/cve/CVE-2026-34910) - [CVE-2026-57309](https://intel.threadlinqs.com/cve/CVE-2026-57309) - [CVE-2026-57310](https://intel.threadlinqs.com/cve/CVE-2026-57310) - [CVE-2026-57311](https://intel.threadlinqs.com/cve/CVE-2026-57311) - [CVE-2026-7482](https://intel.threadlinqs.com/cve/CVE-2026-7482) ## Detection coverage Threadlinqs maintains 32 detection rules mapped to T1070.003 (SPL 8, KQL 11, Sigma 13). Rule content is available to Blue tier accounts and above; this page shows counts only. 32 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1070 Indicator Removal](https://intel.threadlinqs.com/technique/T1070) — 432 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1070.003 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)