Terminal Server Client Connection History Cleared - Registry — Detection Rule

Detects the deletion of registry keys containing the MSTSC connection history

Read the full analysis on IntelFusions