Techniques › T1070 › T1070.009

T1070.009 Clear Persistence

stealth — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

• DET0040 Detection of Persistence Artifact Removal Across Host Platforms v1.0
  AN0113 Windows

  Detects adversary activity that removes persistence artifacts such as services, registry keys, scheduled tasks, user accounts, and binaries through commands like sc delete, schtasks /delete, or reg delete.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Security EventCode=4726, 4657 → DC0009 User Account Deletion

  WinEventLog:TaskScheduler EventCode=106 → DC0001 Scheduled Job Creation

  WinEventLog:Security EventCode=4657 → DC0063 Windows Registry Key Modification

  Tunable: TargetRegistryPathRegex DeletedScheduledTaskName DeletedAccountGroupScope
  AN0114 Linux

  Detects removal of persistence artifacts such as crontab entries, systemd service units, and malicious user accounts through commands like crontab -r, rm /etc/systemd/system/*.service, or userdel.

  auditd:SYSCALL execve → DC0032 Process Creation

  auditd:SYSCALL file deletion → DC0040 File Deletion

  Tunable: ServicePathMatch CronUserScope UserDeletionActivity
  AN0115 macOS

  Detects deletion of launch agents (~/Library/LaunchAgents/) and launch daemons (/Library/LaunchDaemons/), especially after suspicious process execution or when tied to known persistence methods.

  macos:unifiedlog log stream → DC0064 Command Execution

  macos:osquery file_events → DC0040 File Deletion

  Tunable: LaunchDaemonPath CorrelatedProcessImage
  AN0116 ESXi

  Detects adversary removal of persistence implants (e.g., rc.local entries or crontab injections) via CLI (rm, sed, crontab -r) and deletion of startup or management scripts.

  esxi:vmkernel /var/log/vmkernel.log → DC0064 Command Execution

  esxi:shell shell history → DC0040 File Deletion

  Tunable: ScriptRemovalPath StartupEntryClearance

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1070.009

Rules tagged at the parent level (attack.t1070) 20

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.