SplatDropperS1232 ↗
Has deleted its malicious payload and removed its own created service to avoid leaving traces of its presence on victim devices.1
- Tactic
- Stealth
- Platforms
- ESXi, Linux, macOS, Windows
- Version
- 2.0
- Created
- 29 July 2022
- Last modified
- 12 May 2026
- Contributor
- Gavin Knapp
Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, Modify Registry, Plist File Modification, or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.[1] Adversaries may also delete accounts previously created to maintain persistence (i.e. Create Account).[2]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.15
Tools & malwareTop 21%
Tools & malware79th percentile · 79% of ATT&CK techniques have this many tools implementing them or fewer.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Clear Persistence MITRE reference T1070.009
Top 21%of all ATT&CK techniques for number of tools
15 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
KapekaS1190 ↗
Will clear registry values used for persistent configuration storage when uninstalled.1
IPsec HelperS1132 ↗
Can delete various service traces related to persistent execution when commanded.1
Raspberry RobinS1130 ↗
Uses a RunOnce Registry key for persistence, where the key is removed after its use on reboot then re-added by the malware after it resumes execution.1
KOCTOPUSS0669 ↗
Can delete created registry keys used for persistence as part of its cleanup procedure.1
GrimAgentS0632 ↗
Can delete previously created tasks on a compromised host.1
All 15 software entries for this technique · 6 newest in this preview
Offense vs defense T1070.009
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Clear Persistence detection strategy DET0040
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Persistence Artifact Removal Across Host Platforms
4 platforms
AN0113 · Windows
Detects adversary activity that removes persistence artifacts such as services, registry keys, scheduled tasks, user accounts, and binaries through commands like sc delete, schtasks /delete, or reg delete.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Scheduled Job CreationDC0001 | WinEventLog:TaskScheduler | EventCode=106 |
| User Account DeletionDC0009 | WinEventLog:Security | EventCode=4726, 4657 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Security | EventCode=4657 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TargetRegistryPathRegex | Filters known persistence keys like Run/RunOnce, Image File Execution Options |
| DeletedScheduledTaskName | Monitors known or suspicious task names deleted post-persistence |
| DeletedAccountGroupScope | Focuses on highly privileged or recently created accounts |
AN0114 · Linux
Detects removal of persistence artifacts such as crontab entries, systemd service units, and malicious user accounts through commands like crontab -r, rm /etc/systemd/system/*.service, or userdel.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| File DeletionDC0040 | auditd:SYSCALL | file deletion |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ServicePathMatch | Targets suspicious or orphaned unit files in /etc/systemd/system/ |
| CronUserScope | Focus on crontab activity from root or uncommon users |
| UserDeletionActivity | Looks for userdel or passwd deletion |
AN0115 · macOS
Detects deletion of launch agents (~/Library/LaunchAgents/) and launch daemons (/Library/LaunchDaemons/), especially after suspicious process execution or when tied to known persistence methods.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File DeletionDC0040 | macos:osquery | file_events |
| Command ExecutionDC0064 | macos:unifiedlog | log stream |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| LaunchDaemonPath | Common plist file paths for persistence: ~/Library/LaunchAgents/*.plist |
| CorrelatedProcessImage | Ties deletion to parent process (e.g., suspicious AppleScript runner) |
AN0116 · ESXi
Detects adversary removal of persistence implants (e.g., rc.local entries or crontab injections) via CLI (rm, sed, crontab -r) and deletion of startup or management scripts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File DeletionDC0040 | esxi:shell | shell history |
| Command ExecutionDC0064 | esxi:vmkernel | /var/log/vmkernel.log |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ScriptRemovalPath | e.g., /etc/rc.local, /etc/init.d/custom.sh |
| StartupEntryClearance | Wipe or truncate of persistence locations |
Remote Data StorageM1029
Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.
Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.