MITRE ATT&CKsub-technique

T1070.009 Clear Persistence

Published 2022-07-29 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth
Platforms
ESXi, Linux, macOS, Windows
Version
2.0
Created
2022-07-29

Description

Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, Modify Registry, Plist File Modification, or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence. Adversaries may also delete accounts previously created to maintain persistence (i.e. Create Account). In some instances, artifacts of persistence may also be removed once an adversary’s persistence is executed in order to prevent errors with the new instance of the malware.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1070 Indicator Removal technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1022 Restrict File and Directory Permissions mitigation
  • M1029 Remote Data Storage mitigation

Referenced by MITRE ATT&CK · uses (17)

  • S9046 IOControl software (malware)
  • S1232 SplatDropper software (malware)
  • G1045 Salt Typhoon group
  • S1190 Kapeka software (malware)
  • S1132 IPsec Helper software (malware)
  • S1130 Raspberry Robin software (malware)
  • S0669 KOCTOPUS software (malware)
  • S0632 GrimAgent software (malware)
  • S0559 SUNBURST software (malware)
  • S0534 Bazar software (malware)
  • S0500 MCMD software (tool)
  • S0517 Pillowmint software (malware)
  • S0385 njRAT software (malware)
  • S0013 PlugX software (malware)
  • S0083 Misdat software (malware)
  • S0085 S-Type software (malware)
  • S0148 RTM software (malware)

Referenced by Compliance · mitigates (11)

  • CIS-3.4 Enforce Data Retention CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References