Detect Clear Persistence in Elastic Security
Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, modifying the registry, or other cleanup methods to prevent defenders from collecting evidence of their persistent presence. Adversaries may also delete accounts previously created to maintain persistence. In some instances, artifacts of persistence may be removed once an adversary's persistence executes in order to prevent errors with the new instance of the malware.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1070 Indicator Removal
- Sub-technique
- T1070.009 Clear Persistence
- Canonical reference
- https://attack.mitre.org/techniques/T1070/009/
Elastic Detection Query
sequence by host.name with maxspan=5m
[registry where event.type == "deletion" and
registry.path : (
"*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run*",
"*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce*",
"*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*",
"*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*",
"*\\SYSTEM\\CurrentControlSet\\Services*",
"*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders*",
"*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache*"
)]
[any where true]
/* Standalone process-based detections */
any where (
/* Service deletion */
(process.name : "sc.exe" and process.args : ("delete", "stop")) or
/* PowerShell service/task removal */
(process.name : ("powershell.exe", "pwsh.exe") and
process.command_line : ("*Remove-Service*", "*sc.exe delete*", "*Unregister-ScheduledTask*", "*schtasks*delete*")) or
/* schtasks deletion */
(process.name : "schtasks.exe" and process.args : "/delete") or
/* Account deletion */
(process.name : ("net.exe", "net1.exe") and process.command_line : "*user*/delete*") or
(process.name : ("powershell.exe", "pwsh.exe") and process.command_line : ("*Remove-LocalUser*", "*net user*/delete*"))
)Detects T1070.009 Clear Persistence via registry key/value deletion in known persistence locations, service deletion using sc.exe or PowerShell, scheduled task removal via schtasks.exe or Unregister-ScheduledTask, and user account deletion via net.exe or Remove-LocalUser.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate software uninstallers removing their own Run key entries during clean uninstallation
- IT administrators scripting removal of legacy scheduled tasks or services as part of patch management
- Group Policy or MDM solutions like SCCM/Intune removing startup entries during policy enforcement
Other platforms for T1070.009
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Delete Registry Run Key Persistence Entry
Expected signal: Sysmon Event ID 12: RegistryEvent (Object Create/Delete) with TargetObject=HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ArgusTestPersistence, EventType=DeleteValue. Sysmon Event ID 1: Process Create with Image=reg.exe, CommandLine containing 'delete' and 'ArgusTestPersistence'. Security Event ID 4688 (if command line auditing enabled) for reg.exe process creation.
- Test 2Malicious Service Creation and Self-Deletion
Expected signal: System Event ID 7045: New Service Installed (ArgusTestSvc). System Event ID 7036: Service state changes (running, stopped). Sysmon Event ID 1: Multiple process creation events for sc.exe with arguments 'create', 'start', 'stop', 'delete'. Registry: HKLM\SYSTEM\CurrentControlSet\Services\ArgusTestSvc key created then deleted (Sysmon Event ID 12). Security Event ID 4697: Service was installed in the system.
- Test 3Scheduled Task Self-Deletion
Expected signal: Microsoft-Windows-TaskScheduler/Operational Event ID 106: Task Registered (ArgusTestTask). Event ID 141: Task Deleted (ArgusTestTask). Sysmon Event ID 1: Process Create events for schtasks.exe with '/create' then '/delete /tn ArgusTestTask /f'. Registry changes under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache (Sysmon Event ID 12/13).
- Test 4IFEO Registry Key Deletion (SUNBURST-style Cleanup)
Expected signal: Sysmon Event ID 13: RegistryEvent (Value Set) for HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe with value Debugger. Sysmon Event ID 12: RegistryEvent (Object Delete) for the same key after deletion. Sysmon Event ID 1: reg.exe process with command line containing 'Image File Execution Options' and 'Debugger'. Security Event ID 4688 for reg.exe execution.
- Test 5Local User Account Deletion (S-Type/Dust Storm Cleanup)
Expected signal: Security Event ID 4720: User Account Created (TargetUserName=ArgusTestUser). Security Event ID 4726: User Account Deleted (TargetUserName=ArgusTestUser). Sysmon Event ID 1: Two net.exe process creation events — one with '/add' and one with '/delete'. Security Event ID 4688 (if command line auditing enabled) for net.exe executions.
References (11)
- https://attack.mitre.org/techniques/T1070/009/
- https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf
- https://blog.talosintelligence.com/recent-cyber-attack/
- https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/
- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
- https://www.secureworks.com/research/mcmd-malware-analysis
- https://sentinelone.com/labs/from-wiper-to-ransomware-the-evolution-of-agrius/
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4726
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4697
- https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
Unlock Pro Content
Get the full detection package for T1070.009 including response playbook, investigation guide, and atomic red team tests.