MITRE ATT&CK technique · stealth

`T1070.009` Clear Persistence

Sub-technique of T1070 Indicator Removal

Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112), [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

GhostEmperor

Sigma rules to hunt it

SigmaHQ has no rules for this technique.

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.