Detect Clear Persistence in Google Chronicle

rule t1070_009_clear_persistence {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1070.009 - Clear Persistence: removal of registry persistence keys, services, scheduled tasks, or user accounts"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1070.009"
    severity = "HIGH"
    confidence = "HIGH"
    created = "2026-04-13"

  events:
    (
      /* Registry deletion in persistence key paths */
      (
        $e.metadata.event_type = "REGISTRY_DELETION" and
        (
          re.regex($e.target.registry.registry_key, `(?i)(SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon|SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options|SYSTEM\\CurrentControlSet\\Services|SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders|SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache)`) = true
        )
      )
      or
      /* Service deletion via sc.exe */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH" and
        re.regex($e.principal.process.file.full_path, `(?i)sc\.exe$`) = true and
        (
          re.regex($e.target.process.command_line, `(?i)(delete|stop)`) = true
        )
      )
      or
      /* PowerShell persistence cleanup */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH" and
        re.regex($e.principal.process.file.full_path, `(?i)(powershell\.exe|pwsh\.exe)$`) = true and
        (
          re.regex($e.target.process.command_line, `(?i)(Remove-Service|Unregister-ScheduledTask|sc\.exe\s+delete|Remove-LocalUser|schtasks.*\/delete)`) = true
        )
      )
      or
      /* schtasks.exe deletion */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH" and
        re.regex($e.principal.process.file.full_path, `(?i)schtasks\.exe$`) = true and
        re.regex($e.target.process.command_line, `(?i)\/delete`) = true
      )
      or
      /* net.exe account deletion */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH" and
        re.regex($e.principal.process.file.full_path, `(?i)net1?\.exe$`) = true and
        re.regex($e.target.process.command_line, `(?i)user.*\/delete`) = true
      )
      or
      /* Windows Security Event 4726 - User Account Deleted */
      (
        $e.metadata.event_type = "USER_DELETION"
      )
    )

  match:
    $e.principal.hostname over 5m

  outcome:
    $risk_score = max(85)
    $hostname = array_distinct($e.principal.hostname)
    $user = array_distinct($e.principal.user.userid)
    $process = array_distinct($e.principal.process.file.full_path)
    $command = array_distinct($e.target.process.command_line)
    $registry_key = array_distinct($e.target.registry.registry_key)

  condition:
    $e
}