Detection rules › Sigma
RDP Sensitive Settings Changed
Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc. Below is a list of registry keys/values that are monitored by this rule: - Shadow: Used to enable Remote Desktop shadowing, which allows an administrator to view or control a user's session. - DisableRemoteDesktopAntiAlias: Disables anti-aliasing for remote desktop sessions. - DisableSecuritySettings: Disables certain security settings for Remote Desktop connections. - fAllowUnsolicited: Allows unsolicited remote assistance offers. - fAllowUnsolicitedFullControl: Allows unsolicited remote assistance offers with full control. - InitialProgram: Specifies a program to run automatically when a user logs on to a remote computer. - ServiceDll: Used in RDP hijacking techniques to specify a custom DLL to be loaded by the Terminal Services service. - SecurityLayer: Specifies the security layer used for RDP connections.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1112 Modify Registry |
| Defense Evasion | T1112 Modify Registry |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 13 | RegistryEvent (Value Set) |
Stages and Predicates
Stage 1: selection_shadow
Details: ['DWORD (0x00000001)', 'DWORD (0x00000002)', 'DWORD (0x00000003)', 'DWORD (0x00000004)']
or:
TargetObject|contains: '\Control\Terminal Server\'
TargetObject|contains: '\Windows NT\Terminal Services\'
TargetObject|endswith: '\Shadow'
Stage 2: selection_terminal_services_key
or:
TargetObject|endswith: '\DisableRemoteDesktopAntiAlias'
TargetObject|endswith: '\DisableSecuritySettings'
TargetObject|endswith: '\fAllowUnsolicited'
TargetObject|endswith: '\fAllowUnsolicitedFullControl'
or:
TargetObject|contains: '\Control\Terminal Server\'
TargetObject|contains: '\Windows NT\Terminal Services\'
Details: 'DWORD (0x00000001)'
Stage 3: selection_tamper_only
or:
TargetObject|contains: '\Control\Terminal Server\InitialProgram'
TargetObject|contains: '\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram'
TargetObject|contains: '\Terminal Server\WinStations\RDP-Tcp\SecurityLayer'
TargetObject|contains: '\Windows NT\Terminal Services\InitialProgram'
TargetObject|contains: '\services\TermService\Parameters\ServiceDll'
Stage 4: not 1 of filter_main_securitylayer_tls
Details: 'DWORD (0x00000002)'
TargetObject|endswith: '\SecurityLayer'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Details | eq |
|
TargetObject | ends_with |
|
TargetObject | match |
|