Detecting and Mitigating Cleared Network History (T1070.007)

Clear Network Connection History and Configurations (MITRE ATT&CK T1070.007) is a Stealth technique. MITRE lists Linux, macOS, Windows and network devices as platforms.

Behaviors that need network connections, such as Remote Services and External Remote Services, leave configuration settings and history artifacts on a system and in application logs. Defenders use those to watch and analyze connections. Adversaries may clear or remove them to hide the connections they made.

How attackers use it

MITRE gives these places where history lives:

• Windows registry keys HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default and ...\Servers, which hold RDP connection history.
• Files such as Default.rdp in the user's Documents folder, and the Terminal Server Client\Cache folder under the user's local AppData.
• On macOS and Linux, system logs, such as those in /Library/Logs and /var/log/.

Malicious connections may also need changes to third-party applications or network settings, such as disabling or changing the system firewall, or enabling a proxy. Adversaries may delete or change that data to hide indicators and slow analysis.

How to detect it

MITRE's detection strategy has four analytics: Windows registry key deletion, firewall rule changes and deletion of files such as Default.rdp; deletion of logs on Linux that store SSH or proxy activity, such as /var/log/auth.log, or bash history clearing tied to SSH sessions; removal of Remote Login or Screen Sharing logs in macOS Unified Logging, or Terminal use of rm and pfctl -F all; and, on network devices, firewall rule changes or resets of logs and connection tables, such as clear logging, erase startup-config and write erase, after remote access.

Collect registry change events (Sysmon Event ID 13), file deletions, firewall change logs, and AAA accounting on network devices.

How to reduce the risk

MITRE lists two mitigations:

1. Remote data storage. Forward events automatically to a log server or repository so an adversary cannot find and change them on the local system. Keep the delay low.
2. Restrict registry permissions. Protect locally stored event files and logs with proper permissions and authentication, and limit privilege escalation paths.

Quick check

Sources

• MITRE ATT&CK T1070.007: Clear Network Connection History and Configurations