AN0113
Analytic 0113
Windows
Detects adversary activity that removes persistence artifacts such as services, registry keys, scheduled tasks, user accounts, and binaries through commands like `sc delete`, `schtasks /delete`, or `reg delete`.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Security
EventCode=4726, 4657
WinEventLog:TaskScheduler
EventCode=106
WinEventLog:Security
EventCode=4657
[TargetRegistryPathRegex]
Filters known persistence keys like Run/RunOnce, Image File Execution Options
[DeletedScheduledTaskName]
Monitors known or suspicious task names deleted post-persistence
[DeletedAccountGroupScope]
Focuses on highly privileged or recently created accounts
AN0114
Analytic 0114
Linux
Detects removal of persistence artifacts such as crontab entries, systemd service units, and malicious user accounts through commands like `crontab -r`, `rm /etc/systemd/system/*.service`, or `userdel`.
auditd:SYSCALL
execve
auditd:SYSCALL
file deletion
[ServicePathMatch]
Targets suspicious or orphaned unit files in /etc/systemd/system/
[CronUserScope]
Focus on crontab activity from root or uncommon users
[UserDeletionActivity]
Looks for userdel or passwd deletion
AN0115
Analytic 0115
macOS
Detects deletion of launch agents (~/Library/LaunchAgents/) and launch daemons (/Library/LaunchDaemons/), especially after suspicious process execution or when tied to known persistence methods.
macos:unifiedlog
log stream
macos:osquery
file_events
[LaunchDaemonPath]
Common plist file paths for persistence: ~/Library/LaunchAgents/*.plist
[CorrelatedProcessImage]
Ties deletion to parent process (e.g., suspicious AppleScript runner)
AN0116
Analytic 0116
ESXi
Detects adversary removal of persistence implants (e.g., rc.local entries or crontab injections) via CLI (`rm`, `sed`, `crontab -r`) and deletion of startup or management scripts.
esxi:vmkernel
/var/log/vmkernel.log
esxi:shell
shell history
[ScriptRemovalPath]
e.g., /etc/rc.local, /etc/init.d/custom.sh
[StartupEntryClearance]
Wipe or truncate of persistence locations