RDP Sensitive Settings Changed

Title: RDP Sensitive Settings Changed
Status: test
Description:Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc. Below is a list of registry keys/values that are monitored by this rule: - Shadow: Used to enable Remote Desktop shadowing, which allows an administrator to view or control a user's session. - DisableRemoteDesktopAntiAlias: Disables anti-aliasing for remote desktop sessions. - DisableSecuritySettings: Disables certain security settings for Remote Desktop connections. - fAllowUnsolicited: Allows unsolicited remote assistance offers. - fAllowUnsolicitedFullControl: Allows unsolicited remote assistance offers with full control. - InitialProgram: Specifies a program to run automatically when a user logs on to a remote computer. - ServiceDll: Used in RDP hijacking techniques to specify a custom DLL to be loaded by the Terminal Services service. - SecurityLayer: Specifies the security layer used for RDP connections.
References:
  -http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/
  -http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/
  -https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services
  -https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/
  -https://blog.sekoia.io/darkgate-internals/
  -https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/
  -https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-63---disable-remote-desktop-anti-alias-setting-through-registry
  -https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-64---disable-remote-desktop-security-settings-through-registry
  -https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790
  -https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-rdp-winstationextensions-securitylayer
  -https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html
  -https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03
  -https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html
  -https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html
Author: Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali
Date: 2022-08-06
modified:2025-11-22
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1112'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection_shadow:
    TargetObject|contains:
      -'\Control\Terminal Server\'
      -'\Windows NT\Terminal Services\'

    TargetObject|endswith: '\Shadow'
    Details:
      -'DWORD (0x00000001)'
      -'DWORD (0x00000002)'
      -'DWORD (0x00000003)'
      -'DWORD (0x00000004)'

  selection_terminal_services_key:
    TargetObject|contains:
      -'\Control\Terminal Server\'
      -'\Windows NT\Terminal Services\'

    TargetObject|endswith:
      -'\DisableRemoteDesktopAntiAlias'
      -'\DisableSecuritySettings'
      -'\fAllowUnsolicited'
      -'\fAllowUnsolicitedFullControl'

    Details: 'DWORD (0x00000001)'
  selection_tamper_only:
    TargetObject|contains:
      -'\Control\Terminal Server\InitialProgram'
      -'\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram'
      -'\services\TermService\Parameters\ServiceDll'
      -'\Terminal Server\WinStations\RDP-Tcp\SecurityLayer'
      -'\Windows NT\Terminal Services\InitialProgram'

  filter_main_securitylayer_tls:
    TargetObject|endswith: '\SecurityLayer'
    Details: 'DWORD (0x00000002)'
  condition:(selection_shadow or selection_terminal_services_key or selection_tamper_only) and not 1 of filter_main_*
Falsepositives:
  -Some of the keys mentioned here could be modified by an administrator while setting group policy (it should be investigated either way)
Level: high