Terminal Server Client Connection History Cleared

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

This rule detects attempts to clear the connection history for Microsoft Terminal Server Client (MSTSC) by deleting specific registry keys or values. This activity can be performed by an attacker to remove forensic evidence of their remote access to a system.