RDP Trace Removal Detection
Query
DeviceProcessEvents
| where ProcessCommandLine has_all ("delete", "\\Software\\Microsoft\\Terminal Server Client\\Default")
or ProcessCommandLine has_all ("delete", "\\Software\\Microsoft\\Terminal Server Client\\Servers")
or ProcessCommandLine has_all ("add", "\\Software\\Microsoft\\Terminal Server Client\\Servers")
| project Timestamp, DeviceName,DeviceId, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, ReportIdAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1070 | Indicator Removal |
Author: Sergio Albea (18/07/2025)
RDP Trace Removal Detection
By analyzing login sequences, screen tile caches, clipboard data, and session memory, analysts can now reconstruct full attacker activity during Remote Desktop sessions—even if the adversary tries to cover their tracks. The following KQL Query helps to identify when a ransomware attack attempts to remove the mentioned evidence via script which will be identified as executed command.
Explanation
This query is designed to detect attempts to remove traces of activity from Remote Desktop Protocol (RDP) sessions, which is a technique used by attackers to cover their tracks. Specifically, it looks for commands that delete or add entries in certain registry paths related to the Terminal Server Client, which could indicate an attempt to hide evidence of a ransomware attack.
Here's a simple breakdown of what the query does:
-
Data Source: It examines events related to processes on devices (
DeviceProcessEvents). -
Detection Criteria:
- It searches for command lines that include the word "delete" or "add" in combination with specific registry paths associated with RDP client settings.
- These registry paths are
\\Software\\Microsoft\\Terminal Server Client\\Defaultand\\Software\\Microsoft\\Terminal Server Client\\Servers.
-
Output:
- The query outputs relevant details such as the timestamp of the event, the device name and ID, the account name, the file name involved, the full command line of the process, the name of the initiating process, and a report ID for further investigation.
This query helps security analysts identify when an attacker might be trying to remove evidence of their activity during RDP sessions, which is a known technique (T1070) in the MITRE ATT&CK framework for indicator removal.
