Detecting and Mitigating Clear Persistence (T1070.009)

Clear Persistence (MITRE ATT&CK T1070.009) is a Stealth technique. MITRE lists ESXi, Linux, macOS and Windows as platforms.

Adversaries may clear artifacts tied to persistence they set up earlier, so defenders lose evidence of it. That may mean removing services, deleting executables, modifying the registry, changing plist files, or deleting accounts created to keep access. MITRE adds that persistence artifacts may also be removed once persistence has run, to avoid errors with the new instance of the malware.

How attackers use it

The work looks like ordinary admin cleanup. A scheduled task is removed, a service deleted, a launch agent erased. The tell is what happened right before and who did it.

How to detect it

MITRE's detection strategy gives commands per platform:

• Windows: removal of services, registry keys, scheduled tasks, user accounts and binaries through commands such as sc delete, schtasks /delete and reg delete.
• Linux: removal of crontab entries, systemd service units and malicious user accounts through commands such as crontab -r, deleting unit files under /etc/systemd/system, or userdel.
• macOS: deletion of launch agents in ~/Library/LaunchAgents/ and launch daemons in /Library/LaunchDaemons/, especially after suspicious process execution.
• ESXi and similar: removal of persistence implants such as rc.local entries or crontab injections through rm, sed or crontab -r, and deletion of startup or management scripts.

Collect process creation with command line, service and scheduled task change events, account deletion events, and file deletions in startup locations. The pairing to look for is creation followed by removal of the same artifact, which a point-in-time inventory misses.

How to reduce the risk

MITRE lists two mitigations:

1. Restrict file and directory permissions. Protect locally stored event files with proper permissions and authentication, and limit privilege escalation.
2. Remote data storage. Forward events to a log server or repository with minimal delay, so evidence of the persistence outlives the cleanup.

Quick check

Sources

• MITRE ATT&CK T1070.009: Clear Persistence