Sigma rule: Potential Tampering With RDP Related Registry Keys Via Reg.EXE

Rule

Title

Potential Tampering With RDP Related Registry Keys Via Reg.EXE

Status

test

Level

high

Author

pH-T (Nextron Systems), @Kostastsale, TheDFIRReport

Date

2022-02-12

Modified

2025-11-22

File

rules/windows/process_creation/proc_creation_win_reg_rdp_keys_tamper.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values

Log source

product

windows

category

process_creation

Detection

selection_main_img:
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'
selection_main_cli:
    CommandLine|contains|all:
        - ' add '
        - '\CurrentControlSet\Control\Terminal Server'
        - 'REG_DWORD'
        - ' /f'
selection_values_1:
    CommandLine|contains|all:
        - 'Licensing Core'
        - 'EnableConcurrentSessions'
selection_values_2:
    CommandLine|contains:
        - 'AllowTSConnections'
        - 'fDenyTSConnections'
        - 'fEnableWinStation'
        - 'fSingleSessionPerUser'
        - 'IdleWinStationPoolCount'
        - 'MaxInstanceCount'
        - 'SecurityLayer'
        - 'TSAdvertise'
        - 'TSAppCompat'
        - 'TSEnabled'
        - 'TSUserEnabled'
        - 'WinStations\RDP-Tcp'
filter_main_values_tls:
    CommandLine|contains|all:
        - 'SecurityLayer'
        - '02'  # TLS Enabled
condition: all of selection_main_* and 1 of selection_values_* and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.persistence
• attack.lateral-movement
• attack.defense-impairment
• attack.t1021.001
• attack.t1112

MITRE ATT&CK ids this rule names

• T1021.001
• T1112

References

• https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
• http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/
• http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/
• https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services
• https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/
• https://blog.sekoia.io/darkgate-internals/
• https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/
• https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-63---disable-remote-desktop-anti-alias-setting-through-registry
• https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-64---disable-remote-desktop-security-settings-through-registry
• https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790
• https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-rdp-winstationextensions-securitylayer
• https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html
• https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03
• https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html
• https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_reg_rdp_keys_tamper.yml