Elastic medium stable eql

RDP Enabled via Registry

Identifies registry write modifications to enable Remote Desktop Protocol (RDP) access. This could be indicative of adversary lateral movement preparation.

View Source

Detection Logic

registry where host.os.type == "windows" and event.type == "change" and
  registry.value : "fDenyTSConnections" and
  registry.data.strings : ("0", "0x00000000") and
  not process.executable : (
        "?:\\Windows\\System32\\SystemPropertiesRemote.exe",
        "?:\\Windows\\System32\\SystemPropertiesComputerName.exe",
        "?:\\Windows\\System32\\SystemPropertiesAdvanced.exe",
        "?:\\Windows\\System32\\SystemSettingsAdminFlows.exe",
        "?:\\Windows\\WinSxS\\*\\TiWorker.exe",
        "?:\\Windows\\system32\\svchost.exe",
        "\\Device\\HarddiskVolume*\\Windows\\System32\\SystemPropertiesRemote.exe",
        "\\Device\\HarddiskVolume*\\Windows\\System32\\SystemPropertiesComputerName.exe",
        "\\Device\\HarddiskVolume*\\Windows\\System32\\SystemPropertiesAdvanced.exe",
        "\\Device\\HarddiskVolume*\\Windows\\System32\\SystemSettingsAdminFlows.exe",
        "\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*\\TiWorker.exe",
        "\\Device\\HarddiskVolume*\\Windows\\system32\\svchost.exe"
  )

Field Validations

Loading…

Comments (0)

Loading comments...