Sigma rule: RDP Sensitive Settings Changed to Zero

Rule

Title

RDP Sensitive Settings Changed to Zero

Status

test

Level

medium

Author

Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali

Date

2022-09-29

Modified

2022-11-26

File

rules/windows/registry/registry_set/registry_set_terminal_server_suspicious.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects tampering of RDP Terminal Service/Server sensitive settings.
Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|endswith:
        - '\fDenyTSConnections' # Specifies whether Remote Desktop connections are enabled - When set to zero RDP is enabled
        - '\fSingleSessionPerUser' # When changed to 0 it allows multiple RDP sessions
        - '\UserAuthentication' # Specifies that Network-Level user authentication is not required before the remote desktop connection is established
    Details: 'DWORD (0x00000000)'
condition: selection

False positives (as the rule lists them)

• Some of the keys mentioned here could be modified by an administrator while setting group policy (it should be investigated either way)

Tags

• attack.persistence
• attack.defense-impairment
• attack.t1112

MITRE ATT&CK ids this rule names

• T1112

Related rules

• 3f6b7b62-61aa-45db-96bd-9c31b36b653c (similar)
• 4b8f6d3a-9c5e-4f2a-a7d8-6b9c3e5f2a8d (similar)

References

• https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html
• http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/
• https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03
• https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html
• https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/
• http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/
• https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_terminal_server_suspicious.yml