{"id":"3f6b7b62-61aa-45db-96bd-9c31b36b653c","title":"RDP Sensitive Settings Changed","description":"Detects tampering of RDP Terminal Service/Server sensitive settings.\nSuch as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.\n\nBelow is a list of registry keys/values that are monitored by this rule:\n\n- Shadow: Used to enable Remote Desktop shadowing, which allows an administrator to view or control a user's session.\n- DisableRemoteDesktopAntiAlias: Disables anti-aliasing for remote desktop sessions.\n- DisableSecuritySettings: Disables certain security settings for Remote Desktop connections.\n- fAllowUnsolicited: Allows unsolicited remote assistance offers.\n- fAllowUnsolicitedFullControl: Allows unsolicited remote assistance offers with full control.\n- InitialProgram: Specifies a program to run automatically when a user logs on to a remote computer.\n- ServiceDll: Used in RDP hijacking techniques to specify a custom DLL to be loaded by the Terminal Services service.\n- SecurityLayer: Specifies the security layer used for RDP connections.\n","author":"Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali","status":"test","level":"high","date":"2022-08-06","modified":"2025-11-22","tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"technique_ids":["T1112"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Some of the keys mentioned here could be modified by an administrator while setting group policy (it should be investigated either way)"],"references":["http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/","http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/","https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services","https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/","https://blog.sekoia.io/darkgate-internals/","https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/","https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-63---disable-remote-desktop-anti-alias-setting-through-registry","https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-64---disable-remote-desktop-security-settings-through-registry","https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790","https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-rdp-winstationextensions-securitylayer","https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html","https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03","https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html","https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html"],"source_path":"rules/windows/registry/registry_set/registry_set_terminal_server_tampering.yml","source_sha256":"a6a91d052979e3b5a7a41a40156c32b5f4662a3ca53403a9b2174f5918ca54c5","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_terminal_server_tampering.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: RDP Sensitive Settings Changed\nid: 3f6b7b62-61aa-45db-96bd-9c31b36b653c\nrelated:\n    - id: 171b67e1-74b4-460e-8d55-b331f3e32d67\n      type: obsolete\n    - id: 41904ebe-d56c-4904-b9ad-7a77bdf154b3\n      type: obsolete\n    - id: a2863fbc-d5cb-48d5-83fb-d976d4b1743b\n      type: similar\nstatus: test\ndescription: |\n    Detects tampering of RDP Terminal Service/Server sensitive settings.\n    Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.\n\n    Below is a list of registry keys/values that are monitored by this rule:\n\n    - Shadow: Used to enable Remote Desktop shadowing, which allows an administrator to view or control a user's session.\n    - DisableRemoteDesktopAntiAlias: Disables anti-aliasing for remote desktop sessions.\n    - DisableSecuritySettings: Disables certain security settings for Remote Desktop connections.\n    - fAllowUnsolicited: Allows unsolicited remote assistance offers.\n    - fAllowUnsolicitedFullControl: Allows unsolicited remote assistance offers with full control.\n    - InitialProgram: Specifies a program to run automatically when a user logs on to a remote computer.\n    - ServiceDll: Used in RDP hijacking techniques to specify a custom DLL to be loaded by the Terminal Services service.\n    - SecurityLayer: Specifies the security layer used for RDP connections.\nreferences:\n    - http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/ # Contains description for most of the keys mentioned here (check it out if you want more information)\n    - http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/ # Related to the Shadow RPD technique\n    - https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services # Contains description for most of the keys mentioned here (check it out if you want more information)\n    - https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/\n    - https://blog.sekoia.io/darkgate-internals/\n    - https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/\n    - https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-63---disable-remote-desktop-anti-alias-setting-through-registry\n    - https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-64---disable-remote-desktop-security-settings-through-registry\n    - https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790\n    - https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-rdp-winstationextensions-securitylayer\n    - https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html\n    - https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03 # Related to the Shadow RPD technique\n    - https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html # Related to RDP hijacking via the \"ServiceDll\" key\n    - https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html\nauthor: Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali\ndate: 2022-08-06\nmodified: 2025-11-22\ntags:\n    - attack.persistence\n    - attack.defense-impairment\n    - attack.t1112\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection_shadow:\n        TargetObject|contains:\n            - '\\Control\\Terminal Server\\'\n            - '\\Windows NT\\Terminal Services\\'\n        TargetObject|endswith: '\\Shadow'\n        Details:\n            - 'DWORD (0x00000001)' # Full Control with user’s permission\n            - 'DWORD (0x00000002)' # Full Control without user’s permission\n            - 'DWORD (0x00000003)' # View Session with user’s permission\n            - 'DWORD (0x00000004)' # View Session without user’s permission\n    selection_terminal_services_key:\n        TargetObject|contains:\n            - '\\Control\\Terminal Server\\'\n            - '\\Windows NT\\Terminal Services\\'\n        TargetObject|endswith:\n            - '\\DisableRemoteDesktopAntiAlias' # Disable anti-aliasing for remote desktop (DarkGate malware)\n            - '\\DisableSecuritySettings' # Disable security settings, allowing access to programs/entire desktop (DarkGate malware)\n            - '\\fAllowUnsolicited' # Allow unsolicited remote assistance offers\n            - '\\fAllowUnsolicitedFullControl'\n        Details: 'DWORD (0x00000001)'\n    selection_tamper_only:\n        # Any changes to these keys should be suspicious and looked at\n        TargetObject|contains:\n            - '\\Control\\Terminal Server\\InitialProgram' # This value can be set to specify a program to run automatically when a user logs on to a remote computer.\n            - '\\Control\\Terminal Server\\WinStations\\RDP-Tcp\\InitialProgram' # This value can be set to specify a program to run automatically when a user logs on to a remote computer.\n            - '\\services\\TermService\\Parameters\\ServiceDll' # RDP hijacking\n            - '\\Terminal Server\\WinStations\\RDP-Tcp\\SecurityLayer'\n            - '\\Windows NT\\Terminal Services\\InitialProgram' # This value can be set to specify a program to run automatically when a user logs on to a remote computer.\n    filter_main_securitylayer_tls:\n        TargetObject|endswith: '\\SecurityLayer'\n        Details: 'DWORD (0x00000002)' # TLS Enabled\n    condition: (selection_shadow or selection_terminal_services_key or selection_tamper_only) and not 1 of filter_main_*\nfalsepositives:\n    - Some of the keys mentioned here could be modified by an administrator while setting group policy (it should be investigated either way)\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"}],"data_path":"data/detection-rules/3f6b7b62-61aa-45db-96bd-9c31b36b653c.json","kind":"sigma"}