Terminal Server Client Connection History Cleared - Registry

Title: Terminal Server Client Connection History Cleared - Registry
Status: test
Description:Detects the deletion of registry keys containing the MSTSC connection history
References:
  -https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/remove-entries-from-remote-desktop-connection-computer
  -http://woshub.com/how-to-clear-rdp-connections-history/
  -https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html
Author: Christian Burkard (Nextron Systems)
Date: 2021-10-19
modified:2023-02-08
Tags:

• -'attack.persistence'
• -'attack.stealth'
• -'attack.defense-impairment'
• -'attack.t1070'
• -'attack.t1112'

Logsource:

• category: registry_delete
• product: windows

Detection:
  selection1:
    EventType: 'DeleteValue'
    TargetObject|contains: '\Microsoft\Terminal Server Client\Default\MRU'
  selection2:
    EventType: 'DeleteKey'
    TargetObject|contains: '\Microsoft\Terminal Server Client\Servers\'
  condition:1 of selection*
Falsepositives:
  -Unknown
Level: high