T1070.009: Clear Persistence
Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, Modify Registry, Plist File Modification, or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.[1] Adversaries may also delete accounts previously created to maintain persistence (i.e. Create Account).[2]
In some instances, artifacts of persistence may also be removed once an adversary’s persistence is executed in order to prevent errors with the new instance of the malware.[3]
Security context for executives and security teams
Clear Persistence is a stealth behavior where an adversary removes traces of persistence they previously established, such as services, executables, registry changes, plist changes, or accounts. For leaders, the risk is not just cleanup—it can erase the evidence needed to understand scope, prove containment, and make confident incident decisions across Windows, Linux, macOS, and ESXi environments.
Executive priority
Treat this as an incident-readiness and evidence-preservation priority. If persistence artifacts can be deleted without reliable off-host logging or privileged change visibility, responders may lose the timeline needed for containment, audit evidence, and recovery confidence. Executives should ask whether critical hosts forward security telemetry centrally, whether privileged users and processes can modify persistence locations, and whether SOC playbooks explicitly investigate removed persistence—not only newly created persistence.
Technical view
ATT&CK provides no official detection text, but the related DET0040 strategy indicates defenders should monitor persistence artifact removal across host platforms. SOC and IR teams should validate visibility into deletion or modification of services, executables, registry keys, plist files, local accounts, and other host persistence mechanisms. Detection should focus on suspicious removal patterns, especially when performed by unusual users, unexpected processes, remote sessions, or shortly after evidence of persistence creation. Relationship context shows multiple Windows software entries using this behavior, while the technique platforms also include ESXi, Linux, and macOS, so coverage should not be Windows-only.
Likely telemetry
- Endpoint file creation, modification, and deletion events for persistence-relevant paths
- Windows service creation, modification, and deletion audit data
- Windows registry modification and deletion telemetry
- macOS plist modification and deletion telemetry
- Linux and ESXi file and service configuration change logs where available
Detection direction
- Validate that detections cover removal as well as creation of persistence artifacts.
- Correlate artifact deletion with prior persistence indicators, suspicious process execution, or account lifecycle changes.
- Tune for administrative false positives such as software uninstallers, patching, configuration management, and legitimate account deprovisioning.
- Prioritize alerts where deletion is performed by non-standard processes, unusual principals, or outside approved maintenance windows.
- Check blind spots on ESXi, Linux, and macOS, especially where endpoint telemetry is less mature than Windows telemetry.
Mitigation priorities
- Apply M1022 by restricting file and directory permissions so only authorized users, groups, or processes can modify persistence-relevant locations.
- Apply least-privilege access to reduce who can delete services, executables, configuration files, plist files, registry keys, or accounts associated with persistence.
- Apply M1029 by forwarding critical security logs and forensic evidence to secure remote storage so local artifact cleanup does not eliminate the incident record.
- Review privileged administration workflows to ensure legitimate cleanup is auditable and distinguishable from adversary-driven removal.
- Use incident response procedures that preserve volatile and host evidence before remediation removes remaining artifacts.
Additional notes and limits
This technique sits under Indicator Removal and is associated with the stealth tactic. The relationship set includes DET0040 plus mitigations M1022 and M1029, and multiple software examples, many of which are Windows-focused. That relationship context supports prioritizing Windows coverage, but the official platform list also requires validation for ESXi, Linux, and macOS where present in the environment.
MITRE provides no official detection guidance for this object, so detection recommendations are derived from the official description, platforms, tactics, and supplied relationships. Local asset inventory, logging configuration, administrative workflows, and EDR/audit capabilities are required to determine actual coverage. This summary does not assert active exploitation or guaranteed detection.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Clear Persistence
Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, Modify Registry, Plist File Modification, or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.[1] Adversaries may also delete accounts previously created to maintain persistence (i.e. Create Account).[2]
In some instances, artifacts of persistence may also be removed once an adversary’s persistence is executed in order to prevent errors with the new instance of the malware.[3]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1070 | Indicator Removal | This object subtechnique of Indicator Removal. |
Groups, software, and campaigns
S0559: SUNBURST
S0500: MCMD
S0534: Bazar
Bazar is a downloader and backdoor that has been used since at least April 2020, with infections primarily against professional services, healthcare, manufacturing, IT, logistics and travel companies across the US and Europe. Bazar reportedly has ties to TrickBot campaigns and can be used to deploy additional malware, including ransomware, and to steal sensitive data.[1]
S1132: IPsec Helper
IPsec Helper is a post-exploitation remote access tool linked to Agrius operations. This malware shares significant programming and functional overlaps with Apostle ransomware, also linked to Agrius. IPsec Helper provides basic remote access tool functionality such as uploading files from victim systems, running commands, and deploying additional payloads.[1]
S0013: PlugX
S0517: Pillowmint
Pillowmint is a point-of-sale malware used by FIN7 designed to capture credit card information.[1]
S0083: Misdat
Misdat is a backdoor that was used in Operation Dust Storm from 2010 to 2011.[1]
S1190: Kapeka
Kapeka is a backdoor written in C++ used against victims in Eastern Europe since at least mid-2022. Kapeka has technical overlaps with Exaramel for Windows and Prestige malware variants, both of which are linked to Sandworm Team. Kapeka may have been used in advance of Prestige deployment in late 2022.[1][2]
S0085: S-Type
S-Type is a backdoor that was used in Operation Dust Storm since at least 2013.[1]
S0385: njRAT
S0669: KOCTOPUS
S1232: SplatDropper
SplatDropper is a loader that utilizes native windows API to deliver its payload to the victim environment. SplatDropper has been delivered through RAR archives and used legitimate executable for DLL side-loading. SplatDropper is known to be leveraged by Mustang Panda and was first observed utilized in 2025.
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 2.0 | Current bundle | 4bdef41d6ab4… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Cylance Dust Storm
Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.
Open source URL - [2]Talos - Cisco Attack 2022
Nick Biasini. (2022, August 10). Cisco Talos shares insights related to recent cyber attack on Cisco. Retrieved March 9, 2023.
Open source URL - [3]NCC Group Team9 June 2020
Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.
Open source URL - [4]Microsoft Deep Dive Solorigate January 2021
MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.
Open source URL - [5]Secureworks MCMD July 2019
Secureworks. (2019, July 24). MCMD Malware Analysis. Retrieved August 13, 2020.
Open source URL - [6]SentinelOne Agrius 2021
Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.
Open source URL - [7]Eset PlugX Korplug Mustang Panda March 2022
Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.
Open source URL - [8]Trustwave Pillowmint June 2020
Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.
Open source URL - [9]WithSecure Kapeka 2024
Mohammad Kazem Hassan Nejad, WithSecure. (2024, April 17). KAPEKA A novel backdoor spotted in Eastern Europe. Retrieved January 6, 2025.
Open source URL - [10]Trend Micro njRAT 2018
Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019.
Open source URL - [11]MalwareBytes LazyScripter Feb 2021
Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.
Open source URL - [12]Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025
Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2. Retrieved September 12, 2025.
Open source URL - [13]Group IB GrimAgent July 2021
Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.
Open source URL - [14]Microsoft RaspberryRobin 2022
Microsoft Threat Intelligence. (2022, October 27). Raspberry Robin worm part of larger ecosystem facilitating pre-ransomware activity. Retrieved May 17, 2024.
Open source URL - [15]ESET RTM Feb 2017
Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
Open source URL - [16]Cylance Dust Storm
Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.
Open source URL - [17]Cylance Dust Storm
Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.
Open source URL - [18]NCC Group Team9 June 2020
Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.
Open source URL - [19]NCC Group Team9 June 2020
Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.
Open source URL - [20]Talos - Cisco Attack 2022
Nick Biasini. (2022, August 10). Cisco Talos shares insights related to recent cyber attack on Cisco. Retrieved March 9, 2023.
Open source URL - [21]Talos - Cisco Attack 2022
Nick Biasini. (2022, August 10). Cisco Talos shares insights related to recent cyber attack on Cisco. Retrieved March 9, 2023.
Open source URL - [22]mitre-attackT1070.009Open source URL
- [23]mitre-attackT1070.009Open source URL
- [24]mitre-attackT1070.009Open source URL
- [25]Microsoft Deep Dive Solorigate January 2021
MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.
Open source URL - [26]Secureworks MCMD July 2019
Secureworks. (2019, July 24). MCMD Malware Analysis. Retrieved August 13, 2020.
Open source URL - [27]NCC Group Team9 June 2020
Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.
Open source URL - [28]NCC Group Team9 June 2020
Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.
Open source URL - [29]SentinelOne Agrius 2021
Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.
Open source URL - [30]Eset PlugX Korplug Mustang Panda March 2022
Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.
Open source URL - [31]Trustwave Pillowmint June 2020
Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.
Open source URL - [32]Cylance Dust Storm
Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.
Open source URL - [33]Cylance Dust Storm
Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.
Open source URL - [34]WithSecure Kapeka 2024
Mohammad Kazem Hassan Nejad, WithSecure. (2024, April 17). KAPEKA A novel backdoor spotted in Eastern Europe. Retrieved January 6, 2025.
Open source URL - [35]Cylance Dust Storm
Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.
Open source URL - [36]Cylance Dust Storm
Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.
Open source URL - [37]Trend Micro njRAT 2018
Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019.
Open source URL - [38]MalwareBytes LazyScripter Feb 2021
Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.
Open source URL - [39]Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025
Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2. Retrieved September 12, 2025.
Open source URL - [40]Group IB GrimAgent July 2021
Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.
Open source URL - [41]Microsoft RaspberryRobin 2022
Microsoft Threat Intelligence. (2022, October 27). Raspberry Robin worm part of larger ecosystem facilitating pre-ransomware activity. Retrieved May 17, 2024.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.