{"id":"a2863fbc-d5cb-48d5-83fb-d976d4b1743b","title":"RDP Sensitive Settings Changed to Zero","description":"Detects tampering of RDP Terminal Service/Server sensitive settings.\nSuch as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.\n","author":"Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali","status":"test","level":"medium","date":"2022-09-29","modified":"2022-11-26","tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"technique_ids":["T1112"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Some of the keys mentioned here could be modified by an administrator while setting group policy (it should be investigated either way)"],"references":["https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html","http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/","https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03","https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html","https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/","http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/","https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services"],"source_path":"rules/windows/registry/registry_set/registry_set_terminal_server_suspicious.yml","source_sha256":"666928a307ed63e525fbf98e82ca18fd6c818902204cb483842db78fc7675d3b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_terminal_server_suspicious.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: RDP Sensitive Settings Changed to Zero\nid: a2863fbc-d5cb-48d5-83fb-d976d4b1743b\nrelated:\n    - id: 3f6b7b62-61aa-45db-96bd-9c31b36b653c\n      type: similar\n    - id: 4b8f6d3a-9c5e-4f2a-a7d8-6b9c3e5f2a8d\n      type: similar\nstatus: test\ndescription: |\n    Detects tampering of RDP Terminal Service/Server sensitive settings.\n    Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.\nreferences:\n    - https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html # Related to RDP hijacking via the \"ServiceDll\" key\n    - http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/ # Related to the Shadow RPD technique\n    - https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03 # Related to the Shadow RPD technique\n    - https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html\n    - https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/\n    - http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/ # Contain description for most of the keys mentioned here (check it out if you want more information\n    - https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services # Contain description for most of the keys mentioned here (check it out if you want more information)\nauthor: Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali\ndate: 2022-09-29\nmodified: 2022-11-26\ntags:\n    - attack.persistence\n    - attack.defense-impairment\n    - attack.t1112\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection:\n        TargetObject|endswith:\n            - '\\fDenyTSConnections' # Specifies whether Remote Desktop connections are enabled - When set to zero RDP is enabled\n            - '\\fSingleSessionPerUser' # When changed to 0 it allows multiple RDP sessions\n            - '\\UserAuthentication' # Specifies that Network-Level user authentication is not required before the remote desktop connection is established\n        Details: 'DWORD (0x00000000)'\n    condition: selection\nfalsepositives:\n    - Some of the keys mentioned here could be modified by an administrator while setting group policy (it should be investigated either way)\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"}],"data_path":"data/detection-rules/a2863fbc-d5cb-48d5-83fb-d976d4b1743b.json","kind":"sigma"}