UNC3886G1048 ↗
Has cleared specific events that contained the threat actor’s IP address from multiple log sources.1
tfMITRE ATT&CK sub-technique
Clear Network Connection History and Configurations T1070.007
sub-technique of T1070 Indicator Removal
- Tactic
- Stealth
- Platforms
- Linux, macOS, Windows, Network Devices
- Version
- 2.0
- Created
- 15 June 2022
- Last modified
- 12 May 2026
- Contributor
- CrowdStrike Falcon OverWatch
Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as well as various artifacts that highlight connection history may be created on a system and/or in application logs from behaviors that require network connections, such as Remote Services or External Remote Services. Defenders may use these artifacts to monitor or otherwise analyze network connections created by adversaries.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Clear Network Connection History and Configurations MITRE reference T1070.007
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 2 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
RedPenguinC0056 ↗
During RedPenguin, UNC3886 used an implant to delete logs associated with unauthorized access to targeted Junos OS devices.1
All 1 campaigns for this technique
Offense vs defense T1070.007
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Clear Network Connection History and Configurations detection strategy DET0049
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection of Network History and Configuration Tampering
4 platforms
AN0133 · Windows
Detects attempts to clear RDP/network history and modify network configuration artifacts through command execution, registry key deletion, firewall rule changes, and suspicious file deletions (e.g., Default.rdp, registry edits to Terminal Server Client keys).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Firewall Rule ModificationDC0051 | WinEventLog:Security | Firewall Rule Modification |
| Windows Registry Key ModificationDC0063 | WinEventLog:Security | EventCode=4663, 4670, 4656 |
| Command ExecutionDC0064 | EDR:cli | Command Line Telemetry |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TargetPathRegex | Filter file/registry paths like *\Terminal Server Client\* or *Default.rdp* |
| TimeWindow | Correlate command/registry edits within close proximity to suspicious connection activity |
| UserContext | Detect cleanup behavior from non-interactive or SYSTEM accounts |
AN0134 · Linux
Detects deletion or overwriting of logs/configs that store SSH or proxy activity, such as /var/log/auth.log or custom .bash_history clearing tied to SSH sessions or firewall rule changes.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| File ModificationDC0061 | auditd:SYSCALL | PATH |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CommandMatchPattern | Commands like > /var/log/auth.log, rm ~/.bash_history, iptables -F |
| LogPathFilter | Focus on /var/log/auth.log, /etc/ssh/, ~/.bash_history |
AN0135 · macOS
Detects removal of Remote Login or Screen Sharing logs in Unified Logging, deletion of com.apple.UTun, or suspicious Terminal use of rm, sudo pfctl -F all to clear network state/config history.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File ModificationDC0061 | macos:osquery | file_events |
| Command ExecutionDC0064 | macos:unifiedlog | log stream --predicate 'eventMessage contains "loginwindow" or "pfctl"' |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| FilenameMatch | e.g., *com.apple.UTun*, *RemoteManagement* log files |
| TimeDeltaFromLogin | Correlate deletion with recent SSH or GUI remote login session |
AN0136 · Network Devices
Detects firewall rule modifications or reset of logs/connection tables (e.g., clear logging, erase startup-config, write erase) following remote access activity on routers, switches, or VPN appliances.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | networkdevice:syslog | Command Audit / Configuration Change |
| Network Traffic ContentDC0085 | NSM:Flow | Session History Reset |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CommandPattern | e.g., clear logging, no logging buffered, no ip domain-lookup |
| DeviceTypeFilter | Switches vs VPN vs routers |
Remote Data StorageM1029
Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.
Protect generated event files and logs that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.