Persistence artefact removed via service, task or account deletion

Siemphony@siemphonylowT1070.009unverified

Matches process creation where the command line removes one of the artefacts an operator would have had to leave behind to persist: `sc delete` for a service, `schtasks /delete` for a scheduled task, `reg delete` aimed at a Run key, an Image File Execution Options debugger value or a CurrentControlSet\Services key, `net user /delete` for a local account, and the PowerShell cmdlet forms when the cmdlet name is on the command line rather than inside a script file. The service, task, registry and account selections each pair the binary on `Image` with the verb on `CommandLine`, because the verbs alone are far too common to stand on their own; the cmdlet selection has no `Image` gate, since the cmdlet name is distinctive on its own. The registry arm additionally requires a persistence key path — Run/RunOnce and Image File Execution Options are the examples MITRE gives under its `TargetRegistryPathRegex` knob, and the `CurrentControlSet\Services` path is added here — so that `reg delete` of arbitrary configuration does not match. Because that arm is gated on `reg.exe`, the PowerShell registry-provider route (`Remove-ItemProperty -Path 'HKLM:\...\CurrentVersion\Run'`) is not covered. The rule is written in the Sysmon EventID 1 vocabulary the brief names — `Image` and `CommandLine`; a Security 4688 feed carries the same behaviour under `NewProcessName` and needs both Audit Process Creation and the separate Include command line in process creation events policy before `CommandLine` is populated at all, so 4688 cannot be substituted without a field mapping first. The brief's remaining legs are separate feeds with their own field names and are not combined here: 4726 account deletion, 4657 registry value modification, and TaskScheduler 106. Deletion performed through an API — a service control call, `Unregister-ScheduledTask` inside a script block, a registry delete from compiled code — never reaches a command line and is invisible to this rule. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0040, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((((FolderPath endswith "\\sc.exe" and ProcessCommandLine contains " delete ") or (FolderPath endswith "\\schtasks.exe" and (ProcessCommandLine contains "-delete" or ProcessCommandLine contains "/delete" or ProcessCommandLine contains "–delete" or ProcessCommandLine contains "—delete" or ProcessCommandLine contains "―delete"))) or ((FolderPath endswith "\\reg.exe" and ProcessCommandLine contains " delete ") and (ProcessCommandLine contains "\\CurrentVersion\\Run" or ProcessCommandLine contains "\\Image File Execution Options\\" or ProcessCommandLine contains "\\CurrentControlSet\\Services\\"))) or ((FolderPath endswith "\\net.exe" or FolderPath endswith "\\net1.exe") and (ProcessCommandLine contains " user " and ProcessCommandLine contains "/delete"))) or (ProcessCommandLine contains "Unregister-ScheduledTask" or ProcessCommandLine contains "Remove-LocalUser" or ProcessCommandLine contains "Remove-Service"))

Splunk · SPL

Run this as a search.

index=* (((((Image="*\\sc.exe" AND CommandLine="* delete *") OR (Image="*\\schtasks.exe" AND (CommandLine="*-delete*" OR CommandLine="*/delete*" OR CommandLine="*–delete*" OR CommandLine="*—delete*" OR CommandLine="*―delete*"))) OR ((Image="*\\reg.exe" AND CommandLine="* delete *") AND (CommandLine="*\\CurrentVersion\\Run*" OR CommandLine="*\\Image File Execution Options\\*" OR CommandLine="*\\CurrentControlSet\\Services\\*"))) OR ((Image="*\\net.exe" OR Image="*\\net1.exe") AND (CommandLine="* user *" AND CommandLine="*/delete*"))) OR (CommandLine="*Unregister-ScheduledTask*" OR CommandLine="*Remove-LocalUser*" OR CommandLine="*Remove-Service*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((((TO_LOWER(process.executable) LIKE "*\\\\sc.exe" AND TO_LOWER(process.command_line) LIKE "* delete *") OR (TO_LOWER(process.executable) LIKE "*\\\\schtasks.exe" AND (TO_LOWER(process.command_line) LIKE "*-delete*" OR TO_LOWER(process.command_line) LIKE "*/delete*" OR TO_LOWER(process.command_line) LIKE "*–delete*" OR TO_LOWER(process.command_line) LIKE "*—delete*" OR TO_LOWER(process.command_line) LIKE "*―delete*"))) OR ((TO_LOWER(process.executable) LIKE "*\\\\reg.exe" AND TO_LOWER(process.command_line) LIKE "* delete *") AND (TO_LOWER(process.command_line) LIKE "*\\\\currentversion\\\\run*" OR TO_LOWER(process.command_line) LIKE "*\\\\image file execution options\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\currentcontrolset\\\\services\\\\*"))) OR ((TO_LOWER(process.executable) LIKE "*\\\\net.exe" OR TO_LOWER(process.executable) LIKE "*\\\\net1.exe") AND (TO_LOWER(process.command_line) LIKE "* user *" AND TO_LOWER(process.command_line) LIKE "*/delete*"))) OR (TO_LOWER(process.command_line) LIKE "*unregister-scheduledtask*" OR TO_LOWER(process.command_line) LIKE "*remove-localuser*" OR TO_LOWER(process.command_line) LIKE "*remove-service*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 5 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\sc\.exe$</field>    <field name="CommandLine" type="pcre2">(?i) delete </field>    <description>Persistence artefact removed via service, task or account deletion (1/5)</description>    <mitre>      <id>T1070.009</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\schtasks\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(-delete|/delete|–delete|—delete|―delete)</field>    <description>Persistence artefact removed via service, task or account deletion (2/5)</description>    <mitre>      <id>T1070.009</id>    </mitre>  </rule>   <rule id="100002" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\reg\.exe$</field>    <field name="CommandLine" type="pcre2">(?i) delete </field>    <field name="CommandLine" type="pcre2">(?i)(\\CurrentVersion\\Run|\\Image File Execution Options\\|\\CurrentControlSet\\Services\\)</field>    <description>Persistence artefact removed via service, task or account deletion (3/5)</description>    <mitre>      <id>T1070.009</id>    </mitre>  </rule>   <rule id="100003" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\net\.exe$|\\net1\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(?=.*(?: user ))(?=.*(?:/delete)).*</field>    <description>Persistence artefact removed via service, task or account deletion (4/5)</description>    <mitre>      <id>T1070.009</id>    </mitre>  </rule>   <rule id="100004" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(Unregister-ScheduledTask|Remove-LocalUser|Remove-Service)</field>    <description>Persistence artefact removed via service, task or account deletion (5/5)</description>    <mitre>      <id>T1070.009</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: defense_evasion_clear_logs
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: a7435f8e-1f74-4498-8f9e-8410019b13c0

ATT&CKT1070.009

T1070.009Clear Persistence

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondefense evasion clear logs

defense evasion clear logsAI draft — unreviewed

01 · What this rule detects

Command lines that remove one of the artefacts an operator would have had to leave behind to persist: a service, a scheduled task, a Run key or IFEO value, or a local account. AN0113 frames this as clearing persistence; the rule implements the process-creation leg of it. Say the limitation first, because it decides how the rule can be used: nothing here ties the deletion to persistence the same actor established. sc delete against a security service is T1562.001. net user X /delete against a real person is T1531. schtasks /delete during an uninstall is administration. The rule sees the verb, not the intent, which is why its loudest false positive is unfixable rather than tunable.

02 · Telemetry you need

category: process_creation, product: windows, written in the Sysmon EventID 1 vocabulary the brief names — Image and CommandLine. A Security 4688 feed carries the same behaviour under NewProcessName and cannot be substituted without that field mapping; 4688 also needs Audit Process Creation plus the separate Include command line in process creation events policy before CommandLine is populated at all. Neither is on by default.
AN0113's other legs are separate feeds with their own field names and are not combined here: Security 4726 account deletion, 4657 registry value modification, TaskScheduler 106.

03 · How the logic works

Five selections. Four pair a binary with a verb, because the verbs alone are far too common to stand on their own: \sc.exe with ' delete ', \schtasks.exe with '/delete' under windash so the slash and dash forms both match, \net.exe/\net1.exe with ' user ' and '/delete' under contains|all, and \reg.exe with ' delete '. The registry arm is the only one with a second gate. selection_reg_verb must be paired with selection_reg_key in the condition, so reg delete only counts when the target is a persistence path. Run/RunOnce and Image File Execution Options are the examples MITRE gives under its TargetRegistryPathRegex knob; \CurrentControlSet\Services\ is added here, not taken from MITRE. selection_cmdlet is the exception with no Image gate at all — Unregister-ScheduledTask, Remove-LocalUser and Remove-Service are distinctive enough as strings to stand alone. Two gaps follow from the shape. Because the registry arm is bound to reg.exe, the ordinary modern route — Remove-ItemProperty -Path 'HKLM:\...\Run' — matches nothing, even though selection_reg_key already holds the key list needed to gate it. And deletion performed through an API, a service control call, or a cmdlet inside a script file never reaches a command line at all.

04 · Common false positives

Uninstallers, by a wide margin. Application and driver removal calls sc delete for its own service and schtasks /delete for its updater task, and nothing on the command line separates that from an operator cleaning up. Behind it: deployment agents removing stale services and Run values as SYSTEM; helpdesk scripts running net user X /delete on re-issue; vendor repair utilities deleting their own Services key during a self-heal. Hence low.

05 · Detection maturity

tier_1: , and it stays there until it has been run against real data. It is derived from a MITRE scaffold containing no query logic and has never been executed against a log line.
tier_2: run read-only for a fortnight, rank matches by parent process, and suppress the installer and management-agent parents that dominate.
tier_3: ** is the correlation above — pair creation with deletion, so a hit means an artefact appeared and was erased rather than that a package was uninstalled.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Close the disclosed registry gap: add
Populate MITRE's DeletedScheduledTaskName knob with the recurring task names
Do not deploy this as a standalone alert. Correlate each deletion against the

Declared by the author

Application and driver uninstallers, which call sc delete to drop their own service and schtasks /delete to drop their updater task on every uninstall and on many major-version upgrades. On a fleet with normal software churn this is the single largest source of matches in the rule, and nothing on the command line separates it from an operator cleaning up.
Software deployment and configuration-management agents — Configuration Manager task sequences, Intune remediation scripts, Chocolatey and MSI custom actions — that remove stale services, tasks and Run values as SYSTEM during maintenance windows. MITRE's DeletedScheduledTaskName knob, populated with the recurring task names a given estate produces, is where these belong.
Helpdesk and re-imaging scripts running net user <name> /delete to remove a temporary, contractor or shared local account when a machine is re-issued. MITRE's DeletedAccountGroupScope knob is there to narrow this to privileged or recently created accounts.
Endpoint security, backup and printer vendor repair utilities that delete their own CurrentControlSet\Services entry or an Image File Execution Options debugger value as part of a self-heal, uninstall-reinstall or driver rollback.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1070.009, evaluated against their process_creation events.

Share this rule

/u/siemphony/a7435f8e-1f74-4498-8f9e-8410019b13c0

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Persistence artefact removed via service, task or account deletion

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it