T1070.009 — Clear Persistence

Tactic: Stealth · Platforms: ESXi, Linux, macOS, Windows

Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, Modify Registry, Plist File Modification, or other methods of cleanup to…

Sub-technique of Indicator Removal (T1070).

Sigma detection rules (4)

title: "T1070.009 Indicator Removal: Clear Persistence"
id: cfc0c4a4-3a20-4126-9a5a-5ecb8360bc7d
description: 'Detects sc/schtasks/net/reg deletion verbs used to clean up previously established persistence. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TargetRegistryPathRegex, DeletedScheduledTaskName, DeletedAccountGroupScope.'
references:
  - https://attack.mitre.org/techniques/T1070/009
author: Shahrukh Khan
date: 2026-01-25
license: MIT
tags:
  - attack.stealth
  - attack.t1070.009

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_sc_delete:
    EventID: '1'
    Image|endswith: '\sc.exe'
    CommandLine|contains: 'delete'
  selection_schtasks_delete:
    EventID: '1'
    Image|endswith: '\schtasks.exe'
    CommandLine|contains: '/delete'
  selection_net_user_delete:
    EventID: '1'
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains|all:
      - 'user'
      - '/delete'
  selection_reg_delete:
    EventID: '1'
    Image|endswith: '\reg.exe'
    CommandLine|contains: 'delete'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: (1 of selection_*) and not filter_system_account

falsepositives:
  - Legitimate cleanup by IT/deployment tooling.

level: medium

title: "T1070.009 Indicator Removal: Clear Persistence"
id: 901cdcb6-c382-49ec-bcd5-4c7c168a91d5
description: 'Detection of Persistence Artifact Removal Across Host Platforms. (Retargeted to the file_delete auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ServicePathMatch, CronUserScope, UserDeletionActivity.'
references:
  - https://attack.mitre.org/techniques/T1070/009
author: Shahrukh Khan
date: 2026-02-19
license: MIT
tags:
  - attack.stealth
  - attack.t1070.009

logsource:
  category: file_delete
  product: linux

detection:
  selection_unit:
    syscall:
      - unlink
      - unlinkat
    name|contains:
      - '/etc/systemd/system/'
      - '/lib/systemd/system/'
  selection_cron:
    type: EXECVE
    a0|endswith: '/crontab'
    a1: '-r'
  selection_userdel:
    type: EXECVE
    a0|endswith: '/userdel'

  condition: 1 of selection_*

falsepositives:
  - Legitimate uninstall/decommission workflows remove unit files and cron entries and delete accounts; correlate deletion timing with prior unexplained account/service creation to reduce noise.

level: high

title: "T1070.009 Indicator Removal: Clear Persistence"
id: d1090f3e-3efd-4250-8748-7e2910631ef5
description: 'Detection of Persistence Artifact Removal Across Host Platforms. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: LaunchDaemonPath, CorrelatedProcessImage.'
references:
  - https://attack.mitre.org/techniques/T1070/009
author: Shahrukh Khan
date: 2026-05-07
license: MIT
tags:
  - attack.stealth
  - attack.t1070.009

logsource:
  category: process_creation
  product: macos

detection:
  selection_unload:
    Image|endswith: '/launchctl'
    CommandLine|contains: 'unload'
  selection_remove:
    Image|endswith: '/rm'
    CommandLine|contains:
      - '/LaunchAgents/'
      - '/LaunchDaemons/'

  condition: 1 of selection_*

falsepositives:
  - Legitimate uninstaller scripts for commercial software also unload and remove their own launch agents or daemons.

level: medium

title: "T1070.009 Indicator Removal: Clear Persistence"
id: e09d2fd6-67c9-4453-925c-4339ae1d7809
description: 'Detection of Persistence Artifact Removal Across Host Platforms. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ScriptRemovalPath, StartupEntryClearance.'
references:
  - https://attack.mitre.org/techniques/T1070/009
author: Shahrukh Khan
date: 2026-05-18
license: MIT
tags:
  - attack.stealth
  - attack.t1070.009

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - 'rm -f /etc/rc.local.d/'
      - 'esxcli software vib remove'

  condition: selection

falsepositives:
  - Legitimate uninstallation of custom VIBs or startup scripts by administrators during decommissioning also matches this pattern.

level: medium

Related sub-techniques

• T1070.003 Clear Command History
• T1070.008 Clear Mailbox Data
• T1070.004 File Deletion
• T1070.007 Clear Network Connection History and Configurations
• T1070.010 Relocate Malware
• T1070.006 Timestomp
• T1070.005 Network Share Connection Removal

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1070.009 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan