Cross-source coverage
T1070.009 / ATT&CK
Indicator Removal: Clear Persistence
2 rules across 1 source.
From MITRE ATT&CK 19.2
Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, Modify Registry, Plist File Modification, or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence. Adversaries may also delete accounts previously created to maintain persistence (i.e. Create Account).
In some instances, artifacts of persistence may also be removed once an adversary’s persistence is executed in order to prevent errors with the new instance of the malware.
- Tactics
- Stealth
- Platforms
- ESXi · Linux · macOS · Windows
- Telemetry
-
WinEventLog:SysmonWinEventLog:SecurityWinEventLog:TaskSchedulerauditd:SYSCALLmacos:unifiedlogmacos:osqueryesxi:vmkernelesxi:shell
How MITRE says to detect it DET0040
Detection of Persistence Artifact Removal Across Host Platforms
Windows Analytic 0113
Detects adversary activity that removes persistence artifacts such as services, registry keys, scheduled tasks, user accounts, and binaries through commands like `sc delete`, `schtasks /delete`, or `reg delete`.
WinEventLog:SysmonEventCode=1WinEventLog:SecurityEventCode=4726, 4657WinEventLog:TaskSchedulerEventCode=106WinEventLog:SecurityEventCode=4657
Linux Analytic 0114
Detects removal of persistence artifacts such as crontab entries, systemd service units, and malicious user accounts through commands like `crontab -r`, `rm /etc/systemd/system/*.service`, or `userdel`.
auditd:SYSCALLexecveauditd:SYSCALLfile deletion
macOS Analytic 0115
Detects deletion of launch agents (~/Library/LaunchAgents/) and launch daemons (/Library/LaunchDaemons/), especially after suspicious process execution or when tied to known persistence methods.
macos:unifiedloglog streammacos:osqueryfile_events
ESXi Analytic 0116
Detects adversary removal of persistence implants (e.g., rc.local entries or crontab injections) via CLI (`rm`, `sed`, `crontab -r`) and deletion of startup or management scripts.
esxi:vmkernel/var/log/vmkernel.logesxi:shellshell history
panther-labs/panther-analysis
2 rules| Detection | Severity | Format |
|---|---|---|
| Slack App Removed | Medium | Panther Python |
| Wiz User Created Or Deleted | Low | Panther Python |