T1070.009sub-technique of T1070 Indicator Removal

Clear Persistence

ESXi · Linux · macOS · Windowsnothing on this site yetT1070.009 on attack.mitre.org

Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, Modify Registry, Plist File Modification, or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence. Adversaries may also delete accounts previously created to maintain persistence (i.e.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection of Persistence Artifact Removal Across Host Platforms

Detects adversary activity that removes persistence artifacts such as services, registry keys, scheduled tasks, user accounts, and binaries through commands like `sc delete`, `schtasks /delete`, or `reg delete`.
Detects removal of persistence artifacts such as crontab entries, systemd service units, and malicious user accounts through commands like `crontab -r`, `rm /etc/systemd/system/*.service`, or `userdel`.
Detects deletion of launch agents (~/Library/LaunchAgents/) and launch daemons (/Library/LaunchDaemons/), especially after suspicious process execution or when tied to known persistence methods.
Detects adversary removal of persistence implants (e.g., rc.local entries or crontab injections) via CLI (`rm`, `sed`, `crontab -r`) and deletion of startup or management scripts.

what reduces it

M1029 Remote Data Storage. Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.
M1022 Restrict File and Directory Permissions. Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.

the rest of T1070

T1070.003 Clear Command History · not covered yet
T1070.004 File Deletion · 6 on this site
T1070.005 Network Share Connection Removal · not covered yet
T1070.006 Timestomp · 3 on this site
T1070.007 Clear Network Connection History and Configurations · not covered yet
T1070.008 Clear Mailbox Data · not covered yet
T1070.010 Relocate Malware · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.