Which SIEM platforms have a T1070.009 detection rule?

df00tech provides T1070.009 (Clear Persistence) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Clear Persistence (T1070.009)?

Detecting Clear Persistence requires the following data sources: Windows Registry: Registry Key Deletion, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Deletion, Microsoft Defender for Endpoint.

What severity and confidence is the T1070.009 detection?

The T1070.009 detection is rated high severity with medium confidence.

What are common false positives for T1070.009?

Common false positives for T1070.009 include: Software uninstallers legitimately removing their own Run/RunOnce registry entries during uninstallation; IT administrators removing stale scheduled tasks, services, or user accounts during routine maintenance; Endpoint security or patch management tools (SCCM, Intune, PDQ Deploy) that clean up their own persistence entries after completing tasks.

T1070.009 IBM QRadar · QRadar

Detect Clear Persistence in IBM QRadar

Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, modifying the registry, or other cleanup methods to prevent defenders from collecting evidence of their persistent presence. Adversaries may also delete accounts previously created to maintain persistence. In some instances, artifacts of persistence may be removed once an adversary's persistence executes in order to prevent errors with the new instance of the malware.

MITRE ATT&CK

Tactic: Defense Evasion
Technique: T1070 Indicator Removal
Sub-technique: T1070.009 Clear Persistence
Canonical reference: https://attack.mitre.org/techniques/T1070/009/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  CATEGORYNAME(category) AS event_category,
  username,
  sourceip,
  QIDNAME(qid) AS event_name,
  "EventID",
  "CommandLine",
  "Image" AS process_image,
  "ParentImage" AS parent_image,
  "TargetObject" AS registry_target,
  CASE
    WHEN "EventID" IN ('12','13') AND ("TargetObject" ILIKE '%CurrentVersion\\Run%' OR "TargetObject" ILIKE '%CurrentControlSet\\Services%' OR "TargetObject" ILIKE '%Winlogon%' OR "TargetObject" ILIKE '%Image File Execution Options%' OR "TargetObject" ILIKE '%TaskCache%') AND ("EventType" ILIKE '%DeleteKey%' OR "EventType" ILIKE '%DeleteValue%') THEN 'PersistenceRegistryDeleted'
    WHEN "EventID" = '1' AND "Image" ILIKE '%sc.exe' AND ("CommandLine" ILIKE '%delete%' OR "CommandLine" ILIKE '%stop%') THEN 'ServiceDeletion'
    WHEN "EventID" = '1' AND ("Image" ILIKE '%powershell.exe' OR "Image" ILIKE '%pwsh.exe') AND ("CommandLine" ILIKE '%Remove-Service%' OR "CommandLine" ILIKE '%Unregister-ScheduledTask%' OR "CommandLine" ILIKE '%sc.exe delete%') THEN 'ServiceOrTaskDeletion'
    WHEN "EventID" = '1' AND "Image" ILIKE '%schtasks.exe' AND "CommandLine" ILIKE '%/delete%' THEN 'ScheduledTaskDeleted'
    WHEN "EventID" = '1' AND ("Image" ILIKE '%net.exe' OR "Image" ILIKE '%net1.exe') AND "CommandLine" ILIKE '%user%' AND "CommandLine" ILIKE '%/delete%' THEN 'AccountDeleted'
    WHEN "EventID" = '4726' THEN 'AccountDeleted'
    ELSE 'Unknown'
  END AS detection_type
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (12, 13, 14, 385)  -- Sysmon, Windows Security
  AND LAST 24 HOURS
  AND (
    ("EventID" IN ('12','13') AND ("TargetObject" ILIKE '%CurrentVersion\\Run%' OR "TargetObject" ILIKE '%CurrentControlSet\\Services%' OR "TargetObject" ILIKE '%Winlogon%' OR "TargetObject" ILIKE '%Image File Execution Options%' OR "TargetObject" ILIKE '%TaskCache%'))
    OR ("EventID" = '1' AND "Image" ILIKE '%sc.exe' AND ("CommandLine" ILIKE '%delete%' OR "CommandLine" ILIKE '%stop%'))
    OR ("EventID" = '1' AND ("Image" ILIKE '%powershell.exe' OR "Image" ILIKE '%pwsh.exe') AND ("CommandLine" ILIKE '%Remove-Service%' OR "CommandLine" ILIKE '%Unregister-ScheduledTask%' OR "CommandLine" ILIKE '%schtasks%delete%' OR "CommandLine" ILIKE '%Remove-LocalUser%'))
    OR ("EventID" = '1' AND "Image" ILIKE '%schtasks.exe' AND "CommandLine" ILIKE '%/delete%')
    OR ("EventID" = '1' AND ("Image" ILIKE '%net.exe' OR "Image" ILIKE '%net1.exe') AND "CommandLine" ILIKE '%user%' AND "CommandLine" ILIKE '%/delete%')
    OR "EventID" = '4726'
  )
ORDER BY devicetime DESC

high severity high confidence

QRadar AQL detection for T1070.009 covering Sysmon registry deletion events in persistence key paths, sc.exe and PowerShell service deletion, schtasks /delete and Unregister-ScheduledTask, and net.exe or Security Event 4726 account deletion.

Data Sources

Sysmon (EventID 1, 12, 13)Windows Security Log (EventID 4726)Windows System Log

Required Tables

events

False Positives & Tuning

Automated software deployment tools removing startup registry entries after installation phase completes
Security hardening scripts that remove unnecessary scheduled tasks and services as part of CIS benchmark remediation
Help desk staff using net.exe to delete temporary or test accounts created for troubleshooting sessions

Download portable Sigma rule (.yml)

Other platforms for T1070.009

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Delete Registry Run Key Persistence Entry
Expected signal: Sysmon Event ID 12: RegistryEvent (Object Create/Delete) with TargetObject=HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ArgusTestPersistence, EventType=DeleteValue. Sysmon Event ID 1: Process Create with Image=reg.exe, CommandLine containing 'delete' and 'ArgusTestPersistence'. Security Event ID 4688 (if command line auditing enabled) for reg.exe process creation.
Test 2Malicious Service Creation and Self-Deletion
Expected signal: System Event ID 7045: New Service Installed (ArgusTestSvc). System Event ID 7036: Service state changes (running, stopped). Sysmon Event ID 1: Multiple process creation events for sc.exe with arguments 'create', 'start', 'stop', 'delete'. Registry: HKLM\SYSTEM\CurrentControlSet\Services\ArgusTestSvc key created then deleted (Sysmon Event ID 12). Security Event ID 4697: Service was installed in the system.
Test 3Scheduled Task Self-Deletion
Expected signal: Microsoft-Windows-TaskScheduler/Operational Event ID 106: Task Registered (ArgusTestTask). Event ID 141: Task Deleted (ArgusTestTask). Sysmon Event ID 1: Process Create events for schtasks.exe with '/create' then '/delete /tn ArgusTestTask /f'. Registry changes under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache (Sysmon Event ID 12/13).
Test 4IFEO Registry Key Deletion (SUNBURST-style Cleanup)
Expected signal: Sysmon Event ID 13: RegistryEvent (Value Set) for HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe with value Debugger. Sysmon Event ID 12: RegistryEvent (Object Delete) for the same key after deletion. Sysmon Event ID 1: reg.exe process with command line containing 'Image File Execution Options' and 'Debugger'. Security Event ID 4688 for reg.exe execution.
Test 5Local User Account Deletion (S-Type/Dust Storm Cleanup)
Expected signal: Security Event ID 4720: User Account Created (TargetUserName=ArgusTestUser). Security Event ID 4726: User Account Deleted (TargetUserName=ArgusTestUser). Sysmon Event ID 1: Two net.exe process creation events — one with '/add' and one with '/delete'. Security Event ID 4688 (if command line auditing enabled) for net.exe executions.

Last updated: 2026-04-13 Research depth: deep

References (11)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1070.009 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Related Detections

Detect Clear Persistence in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1070.009

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1070.009

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

Get new detections in your inbox