Indicator Removal: Clear Persistence T1070.009
Tactic: Stealth
Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, Modify Registry, Plist File Modification, or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence. Adversaries may also delete accounts previously created to maintain persistence (i.e. Create Account).
Authoring guide
These 2 rules share fields, values, and exclusions.
Fields filtered most (2 distinct)
These fields appear most often in rule filters.
Top indicator values (6 distinct)
These values appear most often in rule predicates.
Rules under this technique
These vendors publish rules tagged with this technique.
Platform: SaaS
Domain: SaaS