Potential Tampering With RDP Related Registry Keys Via Reg.EXE

Severity: high
Author: pH-T (Nextron Systems), @Kostastsale, TheDFIRReport
Source: upstream

Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1112` Modify Registry
Defense Evasion	`T1112` Modify Registry
Lateral Movement	`T1021.001` Remote Services: Remote Desktop Protocol

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `all of selection_main_img`

or:
Image|endswith: '\reg.exe'
OriginalFileName: reg.exe

Stage 2: `all of selection_main_cli`

CommandLine|contains: ' /f'
CommandLine|contains: ' add '
CommandLine|contains: REG_DWORD
CommandLine|contains: '\CurrentControlSet\Control\Terminal Server'

Stage 3: `1 of selection_values_1`

CommandLine|contains: EnableConcurrentSessions
CommandLine|contains: 'Licensing Core'

Stage 4: `1 of selection_values_2`

or:
CommandLine|contains: AllowTSConnections
CommandLine|contains: IdleWinStationPoolCount
CommandLine|contains: MaxInstanceCount
CommandLine|contains: SecurityLayer
CommandLine|contains: TSAdvertise
CommandLine|contains: TSAppCompat
CommandLine|contains: TSEnabled
CommandLine|contains: TSUserEnabled
CommandLine|contains: 'WinStations\RDP-Tcp'
CommandLine|contains: fDenyTSConnections
CommandLine|contains: fEnableWinStation
CommandLine|contains: fSingleSessionPerUser

Stage 5: `not 1 of filter_main_values_tls`

CommandLine|contains: 02
CommandLine|contains: SecurityLayer

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`/f` corpus 2 (sigma 2) `add` corpus 11 (sigma 11) `02` `AllowTSConnections` `EnableConcurrentSessions` `IdleWinStationPoolCount` `Licensing Core` `MaxInstanceCount` `REG_DWORD` `SecurityLayer` `TSAdvertise` `TSAppCompat` `TSEnabled` `TSUserEnabled` `WinStations\RDP-Tcp` `\CurrentControlSet\Control\Terminal Server` `fDenyTSConnections` `fEnableWinStation` `fSingleSessionPerUser`
`Image`	ends_with	`\reg.exe` corpus 46 (sigma 46)
`OriginalFileName`	eq	`reg.exe` corpus 29 (sigma 29)

Potential Tampering With RDP Related Registry Keys Via Reg.EXE

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: all of selection_main_img

Stage 2: all of selection_main_cli

Stage 3: 1 of selection_values_1