Skip to content

Hide Navigation Hide TOC

RDP Sensitive Settings Changed (3f6b7b62-61aa-45db-96bd-9c31b36b653c)

Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.

Below is a list of registry keys/values that are monitored by this rule:

  • Shadow: Used to enable Remote Desktop shadowing, which allows an administrator to view or control a user's session.
  • DisableRemoteDesktopAntiAlias: Disables anti-aliasing for remote desktop sessions.
  • DisableSecuritySettings: Disables certain security settings for Remote Desktop connections.
  • fAllowUnsolicited: Allows unsolicited remote assistance offers.
  • fAllowUnsolicitedFullControl: Allows unsolicited remote assistance offers with full control.
  • InitialProgram: Specifies a program to run automatically when a user logs on to a remote computer.
  • ServiceDll: Used in RDP hijacking techniques to specify a custom DLL to be loaded by the Terminal Services service.
  • SecurityLayer: Specifies the security layer used for RDP connections.
Cluster A Galaxy A Cluster B Galaxy B Level
Modify Registry - T1112 (57340c81-c025-4189-8fa0-fc7ede51bae4) Attack Pattern RDP Sensitive Settings Changed (3f6b7b62-61aa-45db-96bd-9c31b36b653c) Sigma-Rules 1