T1070.010 — Relocate Malware

Tactic: Stealth · Platforms: Linux, macOS, Network Devices, Windows

Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses. Copying malware payloads to new locations may also be combined with File Deletion to cleanup older artifacts. Relocating malware may be…

Sub-technique of Indicator Removal (T1070).

Sigma detection rules (4)

T1070.010 Indicator Removal: Relocate Malware

title: "T1070.010 Indicator Removal: Relocate Malware"
id: a3998c35-2183-4728-b1ca-bc1b074ecf65
description: 'Detects executable/library file drops into common staging or temp directories (AppData\Local\Temp, ProgramData, Users\Public, Windows\Temp), a proxy for adversaries copying/relocating malware payloads to new paths to evade defenses. Corrected logsource category from file_delete to file_event (Sysmon FileCreate, EventID 11), matching the rule own File Creation data-component label and EventID. True relocation detection (the same file hash reappearing under a new path/name) requires cross-event correlation over time, which a single detection rule cannot express — a companion correlation rule grouping by Hashes across distinct TargetFilename values would close this gap. Tune using: SuspiciousTargetPathRegex, TimeWindow, FileExtensionFilter.'
references:
  - https://attack.mitre.org/techniques/T1070/010
author: Shahrukh Khan
date: 2026-03-19
license: MIT
tags:
  - attack.stealth
  - attack.t1070.010

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 11
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\ProgramData\'
      - '\Users\Public\'
      - '\Windows\Temp\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.scr'
      - '.ps1'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and selection_ext and not filter_system_account

falsepositives:
  - Legitimate installers and update processes staging executables in Temp or ProgramData directories.
  - Software using Users\Public as a shared working directory.

level: medium

T1070.010 Indicator Removal: Relocate Malware

title: "T1070.010 Indicator Removal: Relocate Malware"
id: c17e5d3d-2c28-4f52-b9ed-a59a79e3fdca
description: 'Detection of Malware Relocation via Suspicious File Movement. (Fixed an internal logsource/field mismatch: the previous rule declared category: file_change but matched process_creation-style EXECVE argv fields; category is now process_creation to match the telemetry actually used. Destination-path matching is also checked across a1-a3 rather than assuming the destination always lands in a2, since flags like `mv -f` shift argv positions.) Tune using: RelocationPathPatterns, BinaryEntropyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1070/010
author: Shahrukh Khan
date: 2026-06-28
license: MIT
tags:
  - attack.stealth
  - attack.t1070.010

logsource:
  category: process_creation
  product: linux

detection:
  selection_cmd:
    type: EXECVE
    a0|endswith:
      - '/mv'
      - '/cp'
  selection_dest:
    - a1|contains: ['/tmp/','/var/tmp/','/dev/shm/']
    - a2|contains: ['/tmp/','/var/tmp/','/dev/shm/']
    - a3|contains: ['/tmp/','/var/tmp/','/dev/shm/']
  condition: selection_cmd and selection_dest

falsepositives:
  - Legitimate install scripts and container init processes copy/move binaries through /tmp routinely; auditd alone can't measure binary entropy so this only flags relocation into world-writable paths, not the malware relocation behavior itself.

level: low

T1070.010 Indicator Removal: Relocate Malware

title: "T1070.010 Indicator Removal: Relocate Malware"
id: fb007ee2-3f06-450b-933f-b11fd8398bed
description: 'Detection of Malware Relocation via Suspicious File Movement. (Retargeted to the file_change macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TargetBundlePathPattern, QuarantineFlagCheck.'
references:
  - https://attack.mitre.org/techniques/T1070/010
author: Shahrukh Khan
date: 2026-06-05
license: MIT
tags:
  - attack.stealth
  - attack.t1070.010

logsource:
  category: file_change
  product: macos

detection:
  selection:
    TargetFilename|contains|all:
      - '/Applications/'
      - '.app/Contents/MacOS/'

  condition: selection

falsepositives:
  - Legitimate application updates that relocate helper binaries into an existing bundle path produce similar file changes; quarantine-flag correlation is not directly observable from file_change alone.

level: medium

T1070.010 Indicator Removal: Relocate Malware

title: "T1070.010 Indicator Removal: Relocate Malware"
id: 566e2189-62bc-48d9-9b29-170778a1880a
description: 'Detection of Malware Relocation via Suspicious File Movement. (Data Component: Command Execution; baseline tier: fallback.) Checks the a2 argv position for the destination path in an unflagged "mv src dest" or "cp src dest" invocation, since a1 in that shape is the SOURCE path, not the destination. Tune using: StartupConfigPath, CommandPatternMatch.'
references:
  - https://attack.mitre.org/techniques/T1070/010
author: Shahrukh Khan
date: 2026-02-13
license: MIT
tags:
  - attack.stealth
  - attack.t1070.010

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/mv'
      - '/cp'
  selection_dest:
    type: EXECVE
    a2|contains:
      - '/dev/shm'
      - '/tmp/.'
      - '/var/tmp/.'

  condition: selection and selection_dest

falsepositives:
  - Package managers and deployment scripts sometimes stage files through dev/shm or hidden dot-directories for legitimate temporary use.

level: medium

Related sub-techniques

Explore