Sigma rule: RDP Sensitive Settings Changed

Rule

Title

RDP Sensitive Settings Changed

Status

test

Level

high

Author

Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali

Date

2022-08-06

Modified

2025-11-22

File

rules/windows/registry/registry_set/registry_set_terminal_server_tampering.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects tampering of RDP Terminal Service/Server sensitive settings.
Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.

Below is a list of registry keys/values that are monitored by this rule:

- Shadow: Used to enable Remote Desktop shadowing, which allows an administrator to view or control a user's session.
- DisableRemoteDesktopAntiAlias: Disables anti-aliasing for remote desktop sessions.
- DisableSecuritySettings: Disables certain security settings for Remote Desktop connections.
- fAllowUnsolicited: Allows unsolicited remote assistance offers.
- fAllowUnsolicitedFullControl: Allows unsolicited remote assistance offers with full control.
- InitialProgram: Specifies a program to run automatically when a user logs on to a remote computer.
- ServiceDll: Used in RDP hijacking techniques to specify a custom DLL to be loaded by the Terminal Services service.
- SecurityLayer: Specifies the security layer used for RDP connections.

Log source

product

windows

category

registry_set

Detection

selection_shadow:
    TargetObject|contains:
        - '\Control\Terminal Server\'
        - '\Windows NT\Terminal Services\'
    TargetObject|endswith: '\Shadow'
    Details:
        - 'DWORD (0x00000001)' # Full Control with user’s permission
        - 'DWORD (0x00000002)' # Full Control without user’s permission
        - 'DWORD (0x00000003)' # View Session with user’s permission
        - 'DWORD (0x00000004)' # View Session without user’s permission
selection_terminal_services_key:
    TargetObject|contains:
        - '\Control\Terminal Server\'
        - '\Windows NT\Terminal Services\'
    TargetObject|endswith:
        - '\DisableRemoteDesktopAntiAlias' # Disable anti-aliasing for remote desktop (DarkGate malware)
        - '\DisableSecuritySettings' # Disable security settings, allowing access to programs/entire desktop (DarkGate malware)
        - '\fAllowUnsolicited' # Allow unsolicited remote assistance offers
        - '\fAllowUnsolicitedFullControl'
    Details: 'DWORD (0x00000001)'
selection_tamper_only:
    # Any changes to these keys should be suspicious and looked at
    TargetObject|contains:
        - '\Control\Terminal Server\InitialProgram' # This value can be set to specify a program to run automatically when a user logs on to a remote computer.
        - '\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram' # This value can be set to specify a program to run automatically when a user logs on to a remote computer.
        - '\services\TermService\Parameters\ServiceDll' # RDP hijacking
        - '\Terminal Server\WinStations\RDP-Tcp\SecurityLayer'
        - '\Windows NT\Terminal Services\InitialProgram' # This value can be set to specify a program to run automatically when a user logs on to a remote computer.
filter_main_securitylayer_tls:
    TargetObject|endswith: '\SecurityLayer'
    Details: 'DWORD (0x00000002)' # TLS Enabled
condition: (selection_shadow or selection_terminal_services_key or selection_tamper_only) and not 1 of filter_main_*

False positives (as the rule lists them)

• Some of the keys mentioned here could be modified by an administrator while setting group policy (it should be investigated either way)

Tags

• attack.persistence
• attack.defense-impairment
• attack.t1112

MITRE ATT&CK ids this rule names

• T1112

Related rules

• 171b67e1-74b4-460e-8d55-b331f3e32d67 (obsolete)
• 41904ebe-d56c-4904-b9ad-7a77bdf154b3 (obsolete)
• a2863fbc-d5cb-48d5-83fb-d976d4b1743b (similar)

References

• http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/
• http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/
• https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services
• https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/
• https://blog.sekoia.io/darkgate-internals/
• https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/
• https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-63---disable-remote-desktop-anti-alias-setting-through-registry
• https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-64---disable-remote-desktop-security-settings-through-registry
• https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790
• https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-rdp-winstationextensions-securitylayer
• https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html
• https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03
• https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html
• https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_terminal_server_tampering.yml