T1070.007sub-technique of T1070 Indicator Removal
Clear Network Connection History and Configurations
Linux · macOS · Windows · Network Devicesnothing on this site yetT1070.007 on attack.mitre.org
Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as well as various artifacts that highlight connection history may be created on a system and/or in application logs from behaviors that require network connections, such as Remote Services or External Remote Services.
how MITRE says to see it
Behavioral Detection of Network History and Configuration Tampering
- Detects attempts to clear RDP/network history and modify network configuration artifacts through command execution, registry key deletion, firewall rule changes, and suspicious file deletions (e.g., Default.rdp, registry edits to Terminal Server Client keys).
- Detects deletion or overwriting of logs/configs that store SSH or proxy activity, such as /var/log/auth.log or custom.bash_history clearing tied to SSH sessions or firewall rule changes.
- Detects removal of Remote Login or Screen Sharing logs in Unified Logging, deletion of `com.apple.UTun`, or suspicious Terminal use of `rm`, `sudo pfctl -F all` to clear network state/config history.
- Detects firewall rule modifications or reset of logs/connection tables (e.g., `clear logging`, `erase startup-config`, `write erase`) following remote access activity on routers, switches, or VPN appliances.
what reduces it
- M1029 Remote Data Storage. Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.
- M1024 Restrict Registry Permissions. Protect generated event files and logs that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.