Detect Clear Persistence in Splunk
Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, modifying the registry, or other cleanup methods to prevent defenders from collecting evidence of their persistent presence. Adversaries may also delete accounts previously created to maintain persistence. In some instances, artifacts of persistence may be removed once an adversary's persistence executes in order to prevent errors with the new instance of the malware.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1070 Indicator Removal
- Sub-technique
- T1070.009 Clear Persistence
- Canonical reference
- https://attack.mitre.org/techniques/T1070/009/
SPL Detection Query
index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security" OR sourcetype="WinEventLog:System")
| eval detection_type=""
| eval detection_type=case(
EventCode=12 AND (match(TargetObject, "(?i)(SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon|SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options|SYSTEM\\CurrentControlSet\\Services|SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer)") AND match(EventType, "(?i)deletekey|deletevalue")), "PersistenceRegistryDeleted",
EventCode=13 AND match(TargetObject, "(?i)(SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|SYSTEM\\CurrentControlSet\\Services)") AND EventType="DeleteValue", "PersistenceRegistryDeleted",
EventCode=1 AND (match(Image, "(?i)sc\.exe") AND match(CommandLine, "(?i)(delete|stop)")), "ServiceDeletion",
EventCode=1 AND (match(Image, "(?i)(powershell\.exe|pwsh\.exe)") AND match(CommandLine, "(?i)(Remove-Service|sc\.exe\s+delete|Stop-Service)")), "ServiceDeletion",
EventCode=1 AND (match(Image, "(?i)schtasks\.exe") AND match(CommandLine, "(?i)/delete")), "ScheduledTaskDeleted",
EventCode=1 AND (match(Image, "(?i)(powershell\.exe|pwsh\.exe)") AND match(CommandLine, "(?i)(Unregister-ScheduledTask|schtasks.*delete)")), "ScheduledTaskDeleted",
EventCode=1 AND (match(Image, "(?i)net(1)?\.exe") AND match(CommandLine, "(?i)user.*\/delete")), "AccountDeleted",
EventCode=1 AND (match(Image, "(?i)(powershell\.exe|pwsh\.exe)") AND match(CommandLine, "(?i)(Remove-LocalUser|net user.*\/delete)")), "AccountDeleted",
EventCode=4726, "AccountDeleted",
EventCode=7036 AND match(Message, "(?i)service.*stopped"), "ServiceStopped",
true(), ""
)
| where detection_type!=""
| eval process_info=coalesce(Image, "N/A")
| eval cmdline=coalesce(CommandLine, ParentCommandLine, Message, "N/A")
| eval registry_target=coalesce(TargetObject, "N/A")
| eval user=coalesce(User, SubjectUserName, "N/A")
| table _time, host, user, detection_type, process_info, cmdline, registry_target, EventCode, ParentImage, ParentCommandLine
| sort - _timeDetects clearing of persistence artifacts across multiple Windows event sources. Monitors Sysmon Event ID 12/13 for registry key/value deletions in persistence locations, Sysmon Event ID 1 for process creation events indicating service deletion (sc.exe delete), scheduled task removal (schtasks /delete), and account deletion (net user /delete). Also includes Security Event ID 4726 for user account deletion and System Event ID 7036 for service state changes. Combines results from Sysmon, Security, and System event logs.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Software uninstallers legitimately removing their own Run/RunOnce registry entries during uninstallation
- IT administrators removing stale scheduled tasks, services, or user accounts during routine maintenance
- Endpoint security or patch management tools (SCCM, Intune, PDQ Deploy) that clean up their own persistence entries after completing tasks
- Software update processes removing old service entries before reinstalling with new configuration
- Group Policy processing removing or updating startup registry entries during policy refresh
Other platforms for T1070.009
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Delete Registry Run Key Persistence Entry
Expected signal: Sysmon Event ID 12: RegistryEvent (Object Create/Delete) with TargetObject=HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ArgusTestPersistence, EventType=DeleteValue. Sysmon Event ID 1: Process Create with Image=reg.exe, CommandLine containing 'delete' and 'ArgusTestPersistence'. Security Event ID 4688 (if command line auditing enabled) for reg.exe process creation.
- Test 2Malicious Service Creation and Self-Deletion
Expected signal: System Event ID 7045: New Service Installed (ArgusTestSvc). System Event ID 7036: Service state changes (running, stopped). Sysmon Event ID 1: Multiple process creation events for sc.exe with arguments 'create', 'start', 'stop', 'delete'. Registry: HKLM\SYSTEM\CurrentControlSet\Services\ArgusTestSvc key created then deleted (Sysmon Event ID 12). Security Event ID 4697: Service was installed in the system.
- Test 3Scheduled Task Self-Deletion
Expected signal: Microsoft-Windows-TaskScheduler/Operational Event ID 106: Task Registered (ArgusTestTask). Event ID 141: Task Deleted (ArgusTestTask). Sysmon Event ID 1: Process Create events for schtasks.exe with '/create' then '/delete /tn ArgusTestTask /f'. Registry changes under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache (Sysmon Event ID 12/13).
- Test 4IFEO Registry Key Deletion (SUNBURST-style Cleanup)
Expected signal: Sysmon Event ID 13: RegistryEvent (Value Set) for HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe with value Debugger. Sysmon Event ID 12: RegistryEvent (Object Delete) for the same key after deletion. Sysmon Event ID 1: reg.exe process with command line containing 'Image File Execution Options' and 'Debugger'. Security Event ID 4688 for reg.exe execution.
- Test 5Local User Account Deletion (S-Type/Dust Storm Cleanup)
Expected signal: Security Event ID 4720: User Account Created (TargetUserName=ArgusTestUser). Security Event ID 4726: User Account Deleted (TargetUserName=ArgusTestUser). Sysmon Event ID 1: Two net.exe process creation events — one with '/add' and one with '/delete'. Security Event ID 4688 (if command line auditing enabled) for net.exe executions.
References (11)
- https://attack.mitre.org/techniques/T1070/009/
- https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf
- https://blog.talosintelligence.com/recent-cyber-attack/
- https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/
- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
- https://www.secureworks.com/research/mcmd-malware-analysis
- https://sentinelone.com/labs/from-wiper-to-ransomware-the-evolution-of-agrius/
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4726
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4697
- https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
Unlock Pro Content
Get the full detection package for T1070.009 including response playbook, investigation guide, and atomic red team tests.