RDP connection history or firewall state cleared via command line

Siemphony@siemphonylowT1070.007unverified

Matches process creation where a command line removes one of the artefacts that records an inbound or outbound remote-desktop connection, or wipes the local firewall configuration that would show the listener or rule an operator added. The first arm pairs an artefact gate — the `Terminal Server Client` registry path and cache folder, or a `Default.rdp` file — with a removal verb (`reg delete`, `Remove-Item`, `del`, `rd`, `rmdir`), because either half alone is far too common to stand on its own: the paths are read constantly by the RDP client itself, and the verbs appear in most maintenance scripts ever written. The second arm gates `netsh.exe` on `advfirewall` and then on a destructive sub-command (` reset` or `delete rule`), so ordinary `netsh advfirewall show` and `add rule` traffic does not match. The verbs are matched as substrings, so an unrelated token in the same command line can satisfy the verb gate; the artefact gate is what keeps that rare. MITRE's `TargetPathRegex` knob names the `Terminal Server Client` and `Default.rdp` paths; the verb and sub-command lists are authored here. The rule is written in the Sysmon EventID 1 vocabulary the brief names — `Image` and `CommandLine`. A Security 4688 feed carries the same behaviour under `NewProcessName`, and needs both Audit Process Creation and the separate Include command line in process creation events policy before `CommandLine` is populated at all, so 4688 cannot be substituted without a field mapping first; the brief's other legs (Security 4663 mapped onto `file_event`, and 4670/4656 on the raw security service) are likewise separate feeds with their own field names and are not combined here. Deletion performed through an API — `RegDeleteKey` from compiled code, a `.reg` import, or a firewall change via the `NetSecurity` COM/WMI provider — never reaches a command line and is invisible to this rule, and clearing the TerminalServices event channels themselves belongs to T1070.001 rather than here. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0049, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((ProcessCommandLine contains "Terminal Server Client" or ProcessCommandLine contains "Default.rdp") and (ProcessCommandLine contains " delete " or ProcessCommandLine contains "del " or ProcessCommandLine contains "rd " or ProcessCommandLine contains "rmdir " or ProcessCommandLine contains "Remove-Item")) or ((FolderPath endswith "\\netsh.exe" and ProcessCommandLine contains "advfirewall") and (ProcessCommandLine contains " reset" or ProcessCommandLine contains "delete rule")))

Splunk · SPL

Run this as a search.

index=* (((CommandLine="*Terminal Server Client*" OR CommandLine="*Default.rdp*") AND (CommandLine="* delete *" OR CommandLine="*del *" OR CommandLine="*rd *" OR CommandLine="*rmdir *" OR CommandLine="*Remove-Item*")) OR ((Image="*\\netsh.exe" AND CommandLine="*advfirewall*") AND (CommandLine="* reset*" OR CommandLine="*delete rule*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.command_line) LIKE "*terminal server client*" OR TO_LOWER(process.command_line) LIKE "*default.rdp*") AND (TO_LOWER(process.command_line) LIKE "* delete *" OR TO_LOWER(process.command_line) LIKE "*del *" OR TO_LOWER(process.command_line) LIKE "*rd *" OR TO_LOWER(process.command_line) LIKE "*rmdir *" OR TO_LOWER(process.command_line) LIKE "*remove-item*")) OR ((TO_LOWER(process.executable) LIKE "*\\\\netsh.exe" AND TO_LOWER(process.command_line) LIKE "*advfirewall*") AND (TO_LOWER(process.command_line) LIKE "* reset*" OR TO_LOWER(process.command_line) LIKE "*delete rule*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(Terminal Server Client|Default\.rdp)</field>    <field name="CommandLine" type="pcre2">(?i)( delete |del |rd |rmdir |Remove-Item)</field>    <description>RDP connection history or firewall state cleared via command line (1/2)</description>    <mitre>      <id>T1070.007</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\netsh\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)advfirewall</field>    <field name="CommandLine" type="pcre2">(?i)( reset|delete rule)</field>    <description>RDP connection history or firewall state cleared via command line (2/2)</description>    <mitre>      <id>T1070.007</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: defense_evasion_clear_logs
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 21a5f384-458e-4869-8525-4efa3cf18783

ATT&CKT1070.007

T1070.007Clear Network Connection History and Configurations

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondefense evasion clear logs

defense evasion clear logsAI draft — unreviewed

01 · What this rule detects

AN0133 asks for RDP and network-history cleanup on Windows: registry key deletion, firewall rule changes, and deletion of files such as Default.rdp. The rule implements the command-line half of that as two independent arms — removal of an artefact that records a remote-desktop connection, and destruction of the local firewall configuration that would show the listener or rule an operator added. One boundary matters. Clearing the TerminalServices event channels themselves is T1070.001, not this technique. And deletion performed through an API — RegDeleteKey from compiled code, a .reg import, a NetSecurity WMI call — never reaches a command line and is invisible here.

02 · Telemetry you need

category: process_creation / product: windows, copied verbatim from AN0133, in the Sysmon EventID 1 vocabulary: Image and CommandLine.
A Security 4688 feed carries the same behaviour, but under NewProcessName, and it needs both Audit Process Creation and the separate Include command line in process creation events policy before CommandLine is populated at all. It cannot be substituted without a field mapping first. The brief's other legs — Security 4663 mapped onto file_event, and the raw security service — are likewise separate feeds with their own field names and are not combined here.

03 · How the logic works

Arm one ANDs two selections. selection_rdp_artifact matches CommandLine|contains on 'Terminal Server Client' or 'Default.rdp' — MITRE's TargetPathRegex knob names both. selection_removal_verb matches ' delete ', 'del ', 'rd ', 'rmdir ' or 'Remove-Item'; that verb list is authored here, not sourced. Neither half stands alone: the RDP paths are read constantly by the client itself, and the verbs appear in most maintenance scripts ever written. Arm two also ANDs. selection_netsh requires Image|endswith: '\netsh.exe' and CommandLine|contains: 'advfirewall'; selection_netsh_verb then requires a destructive sub-command, ' reset' or 'delete rule'. netsh advfirewall show and add rule therefore do not match. Read the verb list carefully, because the short entries are unanchored substrings. 'rd ' matches inside "Richard "; 'del ' matches inside any token ending del. Paired with the artefact gate that stays rare, but mstsc.exe "C:\Users\Richard Kim\Documents\Default.rdp" — plain RDP usage — satisfies both selections and alerts.

04 · Common false positives

Profile-cleanup and logoff scripts on non-persistent VDI and RDS estates are the highest-volume match by a wide margin: they delete the per-user Terminal Server Client\Servers MRU and cached .rdp files on every session teardown, and that is indistinguishable on the command line from an operator wiping a jump-host trail. Then installer and Intune steps running netsh advfirewall firewall delete rule, helpdesk troubleshooting reaching for netsh advfirewall reset, and privacy tools such as CCleaner clearing the MRU on a schedule. level: low follows from that first entry rather than contradicting it.

05 · Detection maturity

tier_1: . Machine-derived from a MITRE scaffold containing no query logic, never executed against a log line.
tier_2: run read-only for a fortnight and rank hits by parent process; on a VDI estate the cleanup script will dominate and becomes the exclusion the rule currently lacks.
tier_3: ** correlate against a preceding RDP session so the alert means trail-clearing rather than housekeeping.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Anchor the short verbs to ' del ', ' rd ', ' rmdir ' and add the quoted-batch
Reconsider ' reset'. netsh advfirewall reset is ATT&CK's canonical procedure for
Close the coverage gap: Remove-NetFirewallRule runs under PowerShell and never
Populate MITRE's UserContext and TimeWindow knobs downstream — cleanup from a

Declared by the author

Profile-cleanup and logoff scripts on non-persistent VDI and RDS estates, which delete the per-user Terminal Server Client\Servers MRU and the cached .rdp files on every session teardown so the next user does not inherit them. On such an estate this is the highest-volume match in the rule by a wide margin and is indistinguishable on the command line from an operator wiping their own jump-host trail.
VPN, remote-support and endpoint-security installers and uninstallers — and the Configuration Manager or Intune steps that wrap them — running netsh advfirewall firewall delete rule name=... to remove their own inbound rules, or netsh advfirewall reset during imaging to return the host to a known policy baseline.
Helpdesk connectivity troubleshooting, where netsh advfirewall reset is a standard first step for ruling out a local firewall policy as the cause of a ticket, and where stale Terminal Server Client\Servers entries are deleted by hand after a server is renamed or decommissioned.
Privacy and disk-cleaning utilities such as CCleaner and BleachBit, and corporate "clear recent items" scripts, which remove the Terminal Server Client MRU alongside browser, Explorer and Run-dialog history on a schedule.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1070.007, evaluated against their process_creation events.

Share this rule

/u/siemphony/21a5f384-458e-4869-8525-4efa3cf18783

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

RDP connection history or firewall state cleared via command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it