
title: Terminal Server Client Connection History Cleared
author: Christian Burkard
date: 2021/10/19
description: Detects the deletion of registry keys containing the MSTSC connection
  history
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_2:
    EventID: 13
  SELECTION_3:
    EventID: 14
  SELECTION_4:
    EventType: DeleteValue
  SELECTION_5:
    TargetObject: '*\Microsoft\Terminal Server Client\Default\MRU*'
  SELECTION_6:
    EventType: DeleteKey
  SELECTION_7:
    TargetObject: '*\Microsoft\Terminal Server Client\Servers\\*'
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and ((SELECTION_4 and SELECTION_5)
    or (SELECTION_6 and SELECTION_7)))
falsepositives:
- unknown
id: 07bdd2f5-9c58-4f38-aec8-e101bb79ef8d
level: high
logsource:
  category: registry_event
  product: windows
references:
- https://docs.microsoft.com/en-us/troubleshoot/windows-server/remote/remove-entries-from-remote-desktop-connection-computer
- http://woshub.com/how-to-clear-rdp-connections-history/
status: experimental
tags:
- attack.defense_evasion
- attack.t1070
- attack.t1112
ruletype: SIGMA
