Deletion of Terminal History Cache

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the deletion of terminal history cache files, which are often targeted by adversaries attempting to erase evidence of their activities. These cache files typically store information such as Remote Desktop Protocol (RDP) connection history, which can be valuable for forensic investigations. By deleting these files, attackers aim to cover their tracks and hinder incident response efforts. This behavior is commonly associated with defense evasion techniques and may indicate malicious activity, especially in environments where such deletions are uncommon.

2025-05-20 00:00:00

None

ef594542-e0f4-43bc-bffe-6ad23e2314be

attack.defense-evasion attack.t1070.007

Nextron Sigma feed only (private)