Which SIEM platforms have a T1070.007 detection rule?

df00tech provides T1070.007 (Clear Network Connection History and Configurations) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Clear Network Connection History and Configurations (T1070.007)?

Detecting Clear Network Connection History and Configurations requires the following data sources: Windows Registry: Registry Key Deletion, File: File Deletion, Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint.

What severity and confidence is the T1070.007 detection?

The T1070.007 detection is rated medium severity with medium confidence.

What are common false positives for T1070.007?

Common false positives for T1070.007 include: System administrators clearing RDP connection lists as part of routine IT maintenance or user profile cleanup; Enterprise IT tools (SCCM, Group Policy scripts) that reset network configurations during device re-imaging or re-provisioning; Security hardening scripts that flush DNS cache and reset network settings as part of scheduled maintenance windows.

T1070.007 IBM QRadar · QRadar

Detect Clear Network Connection History and Configurations in IBM QRadar

Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as well as various artifacts that highlight connection history may be created on a system and/or in application logs from behaviors that require network connections, such as Remote Services or External Remote Services. Network connection history may be stored in Windows Registry values under HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default and Servers, in files such as Default.rdp and RDP cache files, or in system logs on macOS and Linux. Adversaries may delete or modify this data to conceal indicators and impede defensive analysis.

MITRE ATT&CK

Tactic: Defense Evasion
Technique: T1070 Indicator Removal
Sub-technique: T1070.007 Clear Network Connection History and Configurations
Canonical reference: https://attack.mitre.org/techniques/T1070/007/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS "Event Time",
  LOGSOURCENAME(logsourceid) AS "Log Source",
  username AS "Actor",
  sourceip AS "Source IP",
  QIDNAME(qid) AS "Event Name",
  "EventID" AS "Event ID",
  "TargetObject" AS "Registry Key",
  "TargetFilename" AS "Target File",
  "CommandLine" AS "Command Line",
  CASE
    WHEN "TargetObject" ILIKE '%Terminal Server Client%Default%'
      OR "TargetObject" ILIKE '%Terminal Server Client%Servers%'
      THEN 'RDP Registry History Deletion'
    WHEN "TargetFilename" ILIKE '%Default.rdp%'
      OR "TargetFilename" ILIKE '%Terminal Server Client%Cache%'
      THEN 'RDP File History Deletion'
    ELSE 'CLI Network History Cleanup'
  END AS "Detection Category"
FROM events
WHERE
  (
    -- Sysmon EventCode 12: Registry key or value deletion targeting RDP connection history
    ("EventID" = '12'
      AND (
        "TargetObject" ILIKE '%Terminal Server Client\\Default%'
        OR "TargetObject" ILIKE '%Terminal Server Client\\Servers%'
      )
    )
    OR
    -- Sysmon EventCode 23: File deletion targeting RDP history artifacts
    ("EventID" = '23'
      AND (
        "TargetFilename" ILIKE '%Default.rdp%'
        OR "TargetFilename" ILIKE '%Terminal Server Client%Cache%'
      )
    )
    OR
    -- Sysmon EventCode 1: Process creation with network history cleanup commands
    ("EventID" = '1'
      AND (
        ("CommandLine" ILIKE '%Terminal Server Client%'
          AND ("CommandLine" ILIKE '%del %' OR "CommandLine" ILIKE '%Remove-Item%'
            OR "CommandLine" ILIKE '%reg delete%' OR "CommandLine" ILIKE '%erase %'))
        OR ("CommandLine" ILIKE '%Default.rdp%'
          AND ("CommandLine" ILIKE '%del %' OR "CommandLine" ILIKE '%Remove-Item%'
            OR "CommandLine" ILIKE '%erase %'))
        OR "CommandLine" ILIKE '%netsh wlan delete%'
        OR "CommandLine" ILIKE '%netsh advfirewall reset%'
        OR "CommandLine" ILIKE '%netsh int ip reset%'
        OR "CommandLine" ILIKE '%netsh interface ip reset%'
        OR "CommandLine" ILIKE '%arp -d%'
        OR "CommandLine" ILIKE '%route delete%'
        OR "CommandLine" ILIKE '%Clear-DnsClientCache%'
        OR "CommandLine" ILIKE '%ipconfig /flushdns%'
        OR "CommandLine" ILIKE '%dnscmd /clearcache%'
      )
    )
  )
LAST 24 HOURS
ORDER BY starttime DESC

high severity high confidence

QRadar AQL detection for T1070.007 using Sysmon event IDs 12 (registry object deletion), 23 (file deletion), and 1 (process creation). Identifies adversary attempts to erase RDP connection history from the registry and filesystem, as well as CLI-driven erasure of network configuration state including netsh resets, ARP table flushing, routing table deletion, and DNS cache clearing.

Data Sources

IBM QRadar SIEMMicrosoft Windows Sysmon (QRadar DSM: Microsoft Windows)Windows Security Event Log (QRadar DSM)

Required Tables

events

False Positives & Tuning

Help desk staff following standard SOPs to clear RDP history from workstations during user offboarding or system reassignment
Network engineers executing netsh commands to reset TCP/IP stacks or firewall policies during planned configuration changes
Endpoint protection tools (e.g., CrowdStrike, SentinelOne) flushing the DNS resolver cache or resetting the network stack as part of automated remediation after malware removal

Download portable Sigma rule (.yml)

Other platforms for T1070.007

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Delete RDP Connection History from Registry
Expected signal: Sysmon Event ID 12 (RegistryEvent - Object Delete): TargetObject will contain 'Software\Microsoft\Terminal Server Client\Default' and 'Software\Microsoft\Terminal Server Client\Servers'. Sysmon Event ID 1 (Process Create): reg.exe with CommandLine containing 'reg delete' and 'Terminal Server Client'. Security Event ID 4688 (if command line auditing enabled) showing the reg.exe execution.
Test 2Delete Default RDP Connection File
Expected signal: Sysmon Event ID 11 (File Create): TargetFilename will show the creation of Default.rdp. Sysmon Event ID 23 (File Delete, if enabled): TargetFilename will show the deletion of Default.rdp. Sysmon Event ID 1 (Process Create): cmd.exe with CommandLine containing 'del' and 'Default.rdp'.
Test 3Clear DNS Client Cache to Remove Connection Evidence
Expected signal: Sysmon Event ID 1 (Process Create): ipconfig.exe with CommandLine 'ipconfig /flushdns'. Security Event ID 4688 (if command line auditing enabled) with same data. Note: this is a common operation so additional context (time of day, parent process, user account) is needed to distinguish malicious use.
Test 4Reset Windows Firewall Configuration via Netsh
Expected signal: Sysmon Event ID 1 (Process Create): netsh.exe with CommandLine 'netsh advfirewall reset'. Security Event ID 4688 (if command line auditing enabled). Additionally, Security Event ID 4950 (Windows Firewall setting has changed) may be generated in the Windows Firewall with Advanced Security operational log.
Test 5PowerShell Removal of RDP Cache Directory Contents
Expected signal: Sysmon Event ID 1 (Process Create): powershell.exe with CommandLine containing 'Remove-Item' and 'Terminal Server Client'. Sysmon Event ID 23 (File Delete): TargetFilename showing deletion within the Terminal Server Client\Cache path. PowerShell ScriptBlock Log Event ID 4104 with the full script content.

Last updated: 2026-04-13 Research depth: deep

References (10)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1070.007 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Related Detections

Detect Clear Network Connection History and Configurations in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1070.007

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1070.007

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

Get new detections in your inbox