Windows RDP Cache File Deletion


Description

This detection identifies the deletion of RDP bitmap cache files—specifically .bmc and .bin files—typically stored in the user profile under the Terminal Server Client\Cache directory. These files are created by the native Windows Remote Desktop Client (mstsc.exe) and store graphical elements from remote sessions to improve performance. Deleting these files may indicate an attempt to remove forensic evidence of RDP usage. While rare in legitimate user behavior, this action is commonly associated with defense evasion techniques used by attackers or red teamers who wish to hide traces of interactive remote access. When observed in conjunction with recent logon activity, RDP session indicators, or script execution, this behavior should be treated as potentially malicious. Monitoring for deletion of these files provides valuable visibility into anti-forensic actions that often follow lateral movement or hands-on-keyboard activity.

Query · spl

`sysmon`
EventCode IN (23, 26)
TargetFilename IN (
    "*\\Terminal Server Client\\Cache\\*.bmc",
    "*\\Terminal Server Client\\Cache\\cache*.bin"
)
| stats count min(_time) as firstTime
              max(_time) as lastTime

  by action dest dvc file_path file_hash file_name
     file_modify_time process_exec process_guid process_id
     process_name process_path signature
     signature_id user user_id vendor_product

| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_rdp_cache_file_deletion_filter`

Implementation guide

To successfully implement this search, you must ingest logs that include the process name, TargetFilename, and ProcessID executions from your endpoints. If you are utilizing Sysmon, ensure you have at least version 2.0 of the Sysmon TA installed.

Known false positives

  • False positives will be present, filter as needed or restrict to critical assets on the perimeter.

Analyst notes

Known false positives: False positives will be present, filter as needed or restrict to critical assets on the perimeter.

Raw source Windows RDP Cache File Deletion · SPL
Esc
Published by splunk/security_content ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified.
name: Windows RDP Cache File Deletion
id: f3e86ff3-b1f9-4382-8924-6913385f1019
version: 5
creation_date: '2025-08-06'
modification_date: '2026-07-20'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |-
    This detection identifies the deletion of RDP bitmap cache files—specifically .bmc and .bin files—typically stored in the user profile under the Terminal Server Client\Cache directory.
    These files are created by the native Windows Remote Desktop Client (mstsc.exe) and store graphical elements from remote sessions to improve performance.
    Deleting these files may indicate an attempt to remove forensic evidence of RDP usage.
    While rare in legitimate user behavior, this action is commonly associated with defense evasion techniques used by attackers or red teamers who wish to hide traces of interactive remote access.
    When observed in conjunction with recent logon activity, RDP session indicators, or script execution, this behavior should be treated as potentially malicious. Monitoring for deletion of these files provides valuable visibility into anti-forensic actions that often follow lateral movement or hands-on-keyboard activity.
data_source:
    - Sysmon EventID 23
    - Sysmon EventID 26
search: |-
    `sysmon`
    EventCode IN (23, 26)
    TargetFilename IN (
        "*\\Terminal Server Client\\Cache\\*.bmc",
        "*\\Terminal Server Client\\Cache\\cache*.bin"
    )
    | stats count min(_time) as firstTime
                  max(_time) as lastTime

      by action dest dvc file_path file_hash file_name
         file_modify_time process_exec process_guid process_id
         process_name process_path signature
         signature_id user user_id vendor_product

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_rdp_cache_file_deletion_filter`
how_to_implement: To successfully implement this search, you must ingest logs that include the process name, TargetFilename, and ProcessID executions from your endpoints. If you are utilizing Sysmon, ensure you have at least version 2.0 of the Sysmon TA installed.
known_false_positives: False positives will be present, filter as needed or restrict to critical assets on the perimeter.
references:
    - https://medium.com/@bonguides25/how-to-clear-rdp-connections-history-in-windows-cf0ffb67f344
    - https://thelocalh0st.github.io/posts/rdp/
drilldown_searches:
    - name: View the detection results for - "$user$" and "$dest$"
      search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$user$" and "$dest$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a file related to rdp connection cached has been deleted on $dest$.
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Windows RDP Artifacts and Defense Evasion
asset_type: Endpoint
mitre_attack_id:
    - T1070.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.004/bmc_file_deleted/bmc_file_deleted.log
          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
          sourcetype: XmlWinEventLog
      test_type: unit

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.