{"id":"509e84b9-a71a-40e0-834f-05470369bd1e","title":"Default RDP Port Changed to Non Standard Port","description":"Detects changes to the default RDP port.\nRemote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface.\nMicrosoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).\n","author":"frack113","status":"test","level":"high","date":"2022-01-01","modified":"2024-03-25","tags":["attack.privilege-escalation","attack.persistence","attack.t1547.010"],"technique_ids":["T1547.010"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md"],"source_path":"rules/windows/registry/registry_set/registry_set_change_rdp_port.yml","source_sha256":"8fd6641680a3a22f1bf2bb0daaa0b7ea2e836aa322006a998a4240dc68cdcaab","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_change_rdp_port.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Default RDP Port Changed to Non Standard Port\nid: 509e84b9-a71a-40e0-834f-05470369bd1e\nstatus: test\ndescription: |\n    Detects changes to the default RDP port.\n    Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface.\n    Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md\nauthor: frack113\ndate: 2022-01-01\nmodified: 2024-03-25\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1547.010\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection:\n        TargetObject|endswith: '\\Control\\Terminal Server\\WinStations\\RDP-Tcp\\PortNumber'\n    filter_main_port:\n        Details: DWORD (0x00000d3d) # 3389\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: high\nregression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_change_rdp_port/info.yml\nsimulation:\n    - type: atomic-red-team\n      name: Changing RDP Port to Non Standard Port via Powershell\n      technique: T1021.001\n      atomic_guid: 2f840dd4-8a2e-4f44-beb3-6b2399ea3771\n    - type: atomic-red-team\n      name: Changing RDP Port to Non Standard Port via Command_Prompt\n      technique: T1021.001\n      atomic_guid: 74ace21e-a31c-4f7d-b540-53e4eb6d1f73\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1547.010","id":"T1547.010","name":"Port Monitors","page":"techniques/enterprise/T1547.010/"}],"data_path":"data/detection-rules/509e84b9-a71a-40e0-834f-05470369bd1e.json","kind":"sigma"}