Windows Network Connection History Cleared Remotely

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to clear Windows network connection history remotely over SMB (port 445). It specifically looks for traffic containing the strings "NetworkList" and "delete" (case-insensitive) within TCP sessions directed to the HOME_NET on port 445. This activity could indicate an attacker attempting to remove forensic evidence of their network presence.