T1070 Indicator Removal

2 threats tracked by Spectrum Delta use this technique.

T1070 on MITRE ATT&CK →

• Gheist

  Indicator removal: log retrieved via GitHub API, run deleted seconds later

  GitHub audit logs: workflow run deleted within a minute of completing on a ci-sync-* branch (the paired complete-then-delete signature), plus any API activity carrying the 'gheist' user agent; CloudTrail/GCP/Azure audit: role assumptions or token exchanges whose OIDC subject includes a ci-sync- branch — the primary highlights this as the signal that finds Gheist with no GitHub logs at all

  Seen in: GitHub audit logs

• LiteLLM attack chain

  Stolen-token production approval, run-record deletion and force-push history cover-up

  GitHub organization audit log: the production-gate approval event carrying the second maintainer's token hash (matching the token exfiltrated in P1 — the primary's own correlation), the workflow-run deletion events, and the force-push events for the cover-up; the hashed_token field lets one hash be correlated across the exfiltration, approval and deletion actions (GitHub Docs, A/2). Run-record deletion removes runner logs from the repository but not the audit trail

  Seen in: GitHub organization audit log