Compliance Node Overview
MITRE ATT&CK T1070.009 (Clear Persistence) is an Enterprise Defense Evasion sub-technique of T1070 (Indicator Removal). Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, Modify Registry, Plist File Modification, or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence. Adversaries may also delete accounts previously created to maintain persistence (i.e. Create Account). Affected platforms: Linux, macOS, Windows. MITRE-documented mitigations include M1022 Restrict File and Directory Permissions, M1029 Remote Data Storage. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-02, AC-03, AC-05, AC-06, AC-16, AC-17, AC-18, CA-07.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1070/009/
SHA-256 integrity: 00b9c7407d7a45e6f0bfddaa4c949733676d5349c1377d54575c9b924d43a7bf
Primary Citations — 7 traced to source
- MITRE ATT&CK Technique T1070.009: Clear Persistence (https://attack.mitre.org/techniques/T1070/009/)
- MITRE ATT&CK Tactic TA0005: Defense Evasion (https://attack.mitre.org/tactics/TA0005/)
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access