{"id":"07bdd2f5-9c58-4f38-aec8-e101bb79ef8d","title":"Terminal Server Client Connection History Cleared - Registry","description":"Detects the deletion of registry keys containing the MSTSC connection history","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-10-19","modified":"2023-02-08","tags":["attack.persistence","attack.stealth","attack.defense-impairment","attack.t1070","attack.t1112"],"technique_ids":["T1070","T1112"],"logsource":{"category":"registry_delete","product":"windows"},"falsepositives":["Unknown"],"references":["https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/remove-entries-from-remote-desktop-connection-computer","http://woshub.com/how-to-clear-rdp-connections-history/","https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html"],"source_path":"rules/windows/registry/registry_delete/registry_delete_mstsc_history_cleared.yml","source_sha256":"28549501526d72168de14be7081bf3f8f0a25828e2e258dbeabbb4d345789fd1","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_delete/registry_delete_mstsc_history_cleared.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Terminal Server Client Connection History Cleared - Registry\nid: 07bdd2f5-9c58-4f38-aec8-e101bb79ef8d\nstatus: test\ndescription: Detects the deletion of registry keys containing the MSTSC connection history\nreferences:\n    - https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/remove-entries-from-remote-desktop-connection-computer\n    - http://woshub.com/how-to-clear-rdp-connections-history/\n    - https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html\nauthor: Christian Burkard (Nextron Systems)\ndate: 2021-10-19\nmodified: 2023-02-08\ntags:\n    - attack.persistence\n    - attack.stealth\n    - attack.defense-impairment\n    - attack.t1070\n    - attack.t1112\nlogsource:\n    category: registry_delete\n    product: windows\ndetection:\n    selection1:\n        EventType: DeleteValue\n        TargetObject|contains: '\\Microsoft\\Terminal Server Client\\Default\\MRU'\n    selection2:\n        EventType: DeleteKey\n        TargetObject|contains: '\\Microsoft\\Terminal Server Client\\Servers\\'\n    condition: 1 of selection*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1070","id":"T1070","name":"Indicator Removal","page":"techniques/enterprise/T1070/"},{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"}],"data_path":"data/detection-rules/07bdd2f5-9c58-4f38-aec8-e101bb79ef8d.json","kind":"sigma"}