CyberStack

MITRE ATT&CK / Techniques / T1070.009

Indicator Removal: Clear Persistence

ID
T1070.009
Tactics
TA0005 Stealth
Sub-technique of
T1070 Indicator Removal
Platforms
ESXi, Linux, macOS, Windows
Data sources
Process Creation, User Account Deletion, Scheduled Job Creation, Windows Registry Key Modification, File Deletion, Command Execution
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, Modify Registry, Plist File Modification, or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.[1] Adversaries may also delete accounts previously created to maintain persistence (i.e. Create Account).[2]

In some instances, artifacts of persistence may also be removed once an adversary’s persistence is executed in order to prevent errors with the new instance of the malware.[3]

Detection

Mitigations (2)

M1022 Restrict File and Directory Permissions

Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.

M1029 Remote Data Storage

Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.

Groups (1)

Software (16)

References

  1. Cylance Dust Storm
  2. Talos - Cisco Attack 2022
  3. NCC Group Team9 June 2020