Windows Registry: Clearing RDP Client Connection History via MRU and Server Keys Deletion

title: "Windows Registry: Clearing RDP Client Connection History via MRU and Server Keys Deletion"
id: bdfc5b02-7c27-4d33-a19b-808b835eaf08
status: test
description: This rule detects Windows registry value and key deletions tied to Terminal Server Client connection history, specifically entries under the Default\MRU and Servers paths. Clearing these records can be used to reduce forensic visibility of previously accessed remote desktop hosts and sessions. It relies on registry deletion telemetry indicating either DeleteValue or DeleteKey events targeting matching registry paths.
references:
  - https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/remove-entries-from-remote-desktop-connection-computer
  - http://woshub.com/how-to-clear-rdp-connections-history/
  - https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_delete/registry_delete_mstsc_history_cleared.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-10-19
modified: 2023-02-08
tags:
  - attack.persistence
  - attack.stealth
  - attack.defense-impairment
  - attack.t1070
  - attack.t1112
logsource:
  category: registry_delete
  product: windows
detection:
  selection1:
    EventType: DeleteValue
    TargetObject|contains: \Microsoft\Terminal Server Client\Default\MRU
  selection2:
    EventType: DeleteKey
    TargetObject|contains: \Microsoft\Terminal Server Client\Servers\
  condition: 1 of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 07bdd2f5-9c58-4f38-aec8-e101bb79ef8d
    type: derived