Title:Winlogon AllowMultipleTSSessions Enable Status:test Description:Detects when the 'AllowMultipleTSSessions' value is enabled.
Which allows for multiple Remote Desktop connection sessions to be opened at once.
This is often used by attacker as a way to connect to an RDP session without disconnecting the other users
References: -http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html Author: Nasreddine Bencherchali (Nextron Systems) Date: 2022-09-09 modified:2023-08-17 Tags:
-'attack.persistence'
-'attack.defense-impairment'
-'attack.t1112'
Logsource:
category: registry_set
product: windows
Detection: selection: TargetObject|endswith:
'\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions' Details|endswith:
'DWORD (0x00000001)' condition:selection Falsepositives:
-Legitimate use of the multi session functionality Level:medium
