Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112), [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.(Citation: Cylance Dust Storm) Adversaries may also delete accounts previously created to maintain persistence (i.e. [Create Account](https://attack.mitre.org/techniques/T1136)).(Citation: Talos - Cisco Attack 2022)

In some instances, artifacts of persistence may also be removed once an adversary’s persistence is executed in order to prevent errors with the new instance of the malware.(Citation: NCC Group Team9 June 2020)
Clear Persistence
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1070/009  external_id: T1070.009     source_name: Cylance Dust Storm  description: Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.  url: https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf     source_name: Talos - Cisco Attack 2022  description: Nick Biasini. (2022, August 10). Cisco Talos shares insights related to recent cyber attack on Cisco. Retrieved March 9, 2023.  url: https://blog.talosintelligence.com/recent-cyber-attack/     source_name: NCC Group Team9 June 2020  description: Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.  url: https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/     