T1070.007 — Clear Network Connection History and Configurations

Tactic: Stealth · Platforms: Linux, macOS, Windows, Network Devices

Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as well as various artifacts that highlight connection history may be created on a system and/or in application logs from behaviors that require network…

Sub-technique of Indicator Removal (T1070).

Sigma detection rules (4)

T1070.007 Indicator Removal: Clear Network Connection History and Configurations

title: "T1070.007 Indicator Removal: Clear Network Connection History and Configurations"
id: fb73ecbd-7607-4c55-92c4-0a2ce6275078
description: 'Detects deletion of RDP connection-history registry values/keys under HKCU\Software\Microsoft\Terminal Server Client (Default and Servers), the artifact this technique actually clears (the previous version matched netsh advfirewall delete, which is firewall-rule tampering, T1562.004, not network-connection-history clearing). Tune using: TargetPathRegex, TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1070/007
author: Shahrukh Khan
date: 2026-05-16
license: MIT
tags:
  - attack.stealth
  - attack.t1070.007

logsource:
  category: registry_event
  product: windows
  service: sysmon

detection:
  selection:
    EventType:
      - 'DeleteKey'
      - 'DeleteValue'
    TargetObject|contains:
      - '\Software\Microsoft\Terminal Server Client\Default'
      - '\Software\Microsoft\Terminal Server Client\Servers'

  condition: selection

falsepositives:
  - Legitimate profile cleanup or Group Policy-driven clearing of RDP connection history -- rare enough that it warrants review either way.

level: medium

T1070.007 Indicator Removal: Clear Network Connection History and Configurations

title: "T1070.007 Indicator Removal: Clear Network Connection History and Configurations"
id: ccff59a2-b59c-45f0-a22a-7bbebdce1390
description: 'Behavioral Detection of Network Connection History Tampering. The prior version detected iptables/nft/conntrack -F flush activity, which is firewall-rule and connection-table tampering - a T1562.004 (Disable or Modify System Firewall) behavior, not clearing of connection-HISTORY logs as T1070.007 actually describes. Retargeted to deletion/truncation of login and connection-history log files (wtmp, utmp, btmp, auth.log, secure) and abuse of journalctl log-vacuuming, the Linux-observable artifacts that actually record prior network/remote-service connections. Tune using: CommandMatchPattern, LogPathFilter.'
references:
  - https://attack.mitre.org/techniques/T1070/007
author: Shahrukh Khan
date: 2026-02-22
license: MIT
tags:
  - attack.stealth
  - attack.t1070.007

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_log_delete:
    type: PATH
    nametype: DELETE
    name|endswith:
      - '/var/log/wtmp'
      - '/var/log/utmp'
      - '/var/log/btmp'
      - '/var/log/auth.log'
      - '/var/log/secure'
  selection_truncate:
    type: EXECVE
    a0|endswith:
      - '/truncate'
      - '/shred'
    a1|contains:
      - 'wtmp'
      - 'utmp'
      - 'btmp'
      - 'auth.log'
  selection_journal_vacuum:
    type: EXECVE
    a0|endswith: '/journalctl'
    a1|contains:
      - '--vacuum-time'
      - '--vacuum-size'
      - '--vacuum-files'

  condition: 1 of selection_*

falsepositives:
  - Log rotation utilities (logrotate) and routine journalctl vacuum maintenance jobs configured by administrators also delete or rotate these same files; scope CommandMatchPattern/LogPathFilter to unexpected users or the absence of a scheduled logrotate/cron entry.

level: medium

T1070.007 Indicator Removal: Clear Network Connection History and Configurations

title: "T1070.007 Indicator Removal: Clear Network Connection History and Configurations"
id: f79d95ff-f5b3-4a32-801d-509d71dd5791
description: 'Behavioral Detection of Network History and Configuration Tampering. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: FilenameMatch, TimeDeltaFromLogin.'
references:
  - https://attack.mitre.org/techniques/T1070/007
author: Shahrukh Khan
date: 2026-06-09
license: MIT
tags:
  - attack.stealth
  - attack.t1070.007

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    CommandLine|contains:
      - 'pfctl -f /dev/null'
      - '/etc/pf.conf'
      - 'networksetup -deletelocation'
      - 'scutil --nc'

  condition: selection

falsepositives:
  - Network administrators reconfiguring the packet filter or VPN network locations trigger the same commands.

level: medium

T1070.007 Indicator Removal: Clear Network Connection History and Configurations

title: "T1070.007 Indicator Removal: Clear Network Connection History and Configurations"
id: 74282a4c-0b3d-4613-b710-5a0dce5acc75
description: 'Detects deletion/rotation of connection-history artifacts (wtmp/utmp/btmp login records, auth.log/secure) and abuse of journalctl log-vacuuming, the auditd-observable behaviors that actually match T1070.007 (clearing connection-history logs), rather than the previous logic which detected firewall/route/neighbor-table flushing - a T1562.004 (Disable or Modify System Firewall) behavior, not history clearing. Tune using: CommandPattern, DeviceTypeFilter.'
references:
  - https://attack.mitre.org/techniques/T1070/007
author: Shahrukh Khan
date: 2026-05-08
license: MIT
tags:
  - attack.stealth
  - attack.t1070.007

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_journal_vacuum:
    type: EXECVE
    a0|endswith: '/journalctl'
    a1|contains:
      - '--vacuum-time'
      - '--vacuum-size'
      - '--vacuum-files'
      - '--rotate'
  selection_log_delete:
    type: PATH
    nametype: DELETE
    name|endswith:
      - '/var/log/wtmp'
      - '/var/log/utmp'
      - '/var/log/btmp'
      - '/var/log/auth.log'
      - '/var/log/secure'
  selection_truncate:
    type: EXECVE
    a0|endswith:
      - '/truncate'
      - '/shred'
    a1|contains:
      - 'wtmp'
      - 'utmp'
      - 'btmp'
      - 'auth.log'

  condition: 1 of selection_*

falsepositives:
  - Log rotation utilities (logrotate) and routine journalctl vacuum maintenance jobs configured by administrators also delete or rotate these same files; correlate with an unexpected user/session or absence of a scheduled logrotate/cron entry.

level: medium

Related sub-techniques

Explore