Sigma rule: RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class

Rule

Title

RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class

Status

experimental

Level

medium

Author

Daniel Koifman (KoifSec), Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-11-15

File

rules/windows/process_creation/proc_creation_win_rdp_enable_or_disable_via_win32_terminalservicesetting_wmi_class.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell.
In PowerShell one-liner commands, the "SetAllowTSConnections" method of the "Win32_TerminalServiceSetting" class may be used to enable or disable RDP.
In WMIC, the "rdtoggle" alias or "Win32_TerminalServiceSetting" class may be used for the same purpose.

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith:
          - '\wmic.exe'
          - '\powershell.exe'
          - '\pwsh.exe'
    - OriginalFileName:
          - 'wmic.exe'
          - 'PowerShell.EXE'
          - 'pwsh.dll'
selection_cli_method:
    CommandLine|contains:
        - 'rdtoggle'
        - 'Win32_TerminalServiceSetting'
selection_cli_property:
    CommandLine|contains: 'SetAllowTSConnections'
condition: all of selection_*

False positives (as the rule lists them)

• Legitimate system administrators enabling RDP for remote support
• System configuration scripts during deployment

Tags

• attack.lateral-movement
• attack.t1021.001
• attack.execution
• attack.t1047

MITRE ATT&CK ids this rule names

• T1021.001
• T1047

Related rules

• a2863fbc-d5cb-48d5-83fb-d976d4b1743b (similar)

References

• https://www.trendmicro.com/en_gb/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html
• https://github.com/HackTricks-wiki/hacktricks/blob/72f20a3fa26775b932bd819f1824c6377802a768/src/windows-hardening/basic-cmd-for-pentesters.md#firewall
• https://github.com/Lifailon/RSA/blob/rsa/Sources/RSA-1.4.1.ps1#L1468

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_rdp_enable_or_disable_via_win32_terminalservicesetting_wmi_class.yml