{"id":"0d5675be-bc88-4172-86d3-1e96a4476536","title":"Potential Tampering With RDP Related Registry Keys Via Reg.EXE","description":"Detects the execution of \"reg.exe\" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\\Control\\Terminal Server' values","author":"pH-T (Nextron Systems), @Kostastsale, TheDFIRReport","status":"test","level":"high","date":"2022-02-12","modified":"2025-11-22","tags":["attack.persistence","attack.lateral-movement","attack.defense-impairment","attack.t1021.001","attack.t1112"],"technique_ids":["T1021.001","T1112"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/","http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/","http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/","https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services","https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/","https://blog.sekoia.io/darkgate-internals/","https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/","https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-63---disable-remote-desktop-anti-alias-setting-through-registry","https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-64---disable-remote-desktop-security-settings-through-registry","https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790","https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-rdp-winstationextensions-securitylayer","https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html","https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03","https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html","https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html"],"source_path":"rules/windows/process_creation/proc_creation_win_reg_rdp_keys_tamper.yml","source_sha256":"f85d5f46de1f20db284d485f6d5dfe7101b45746051643b5a8364ce55d43cc8a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_rdp_keys_tamper.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Tampering With RDP Related Registry Keys Via Reg.EXE\nid: 0d5675be-bc88-4172-86d3-1e96a4476536\nstatus: test\ndescription: Detects the execution of \"reg.exe\" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\\Control\\Terminal Server' values\nreferences:\n    - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/\n    - http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/ # Contain description for most of the keys mentioned here (check it out if you want more information\n    - http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/ # Related to the Shadow RPD technique\n    - https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services # Contain description for most of the keys mentioned here (check it out if you want more information)\n    - https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/\n    - https://blog.sekoia.io/darkgate-internals/\n    - https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/\n    - https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-63---disable-remote-desktop-anti-alias-setting-through-registry\n    - https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-64---disable-remote-desktop-security-settings-through-registry\n    - https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790\n    - https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-rdp-winstationextensions-securitylayer\n    - https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html\n    - https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03 # Related to the Shadow RPD technique\n    - https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html # Related to RDP hijacking via the \"ServiceDll\" key\n    - https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html\nauthor: pH-T (Nextron Systems), @Kostastsale, TheDFIRReport\ndate: 2022-02-12\nmodified: 2025-11-22\ntags:\n    - attack.persistence\n    - attack.lateral-movement\n    - attack.defense-impairment\n    - attack.t1021.001\n    - attack.t1112\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_main_img:\n        - Image|endswith: '\\reg.exe'\n        - OriginalFileName: 'reg.exe'\n    selection_main_cli:\n        CommandLine|contains|all:\n            - ' add '\n            - '\\CurrentControlSet\\Control\\Terminal Server'\n            - 'REG_DWORD'\n            - ' /f'\n    selection_values_1:\n        CommandLine|contains|all:\n            - 'Licensing Core'\n            - 'EnableConcurrentSessions'\n    selection_values_2:\n        CommandLine|contains:\n            - 'AllowTSConnections'\n            - 'fDenyTSConnections'\n            - 'fEnableWinStation'\n            - 'fSingleSessionPerUser'\n            - 'IdleWinStationPoolCount'\n            - 'MaxInstanceCount'\n            - 'SecurityLayer'\n            - 'TSAdvertise'\n            - 'TSAppCompat'\n            - 'TSEnabled'\n            - 'TSUserEnabled'\n            - 'WinStations\\RDP-Tcp'\n    filter_main_values_tls:\n        CommandLine|contains|all:\n            - 'SecurityLayer'\n            - '02'  # TLS Enabled\n    condition: all of selection_main_* and 1 of selection_values_* and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1021.001","id":"T1021.001","name":"Remote Desktop Protocol","page":"techniques/enterprise/T1021.001/"},{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"}],"data_path":"data/detection-rules/0d5675be-bc88-4172-86d3-1e96a4476536.json","kind":"sigma"}