Suspicious Winlogon AllowMultipleTSSessions Enable (via registry_set)

title: Suspicious Winlogon AllowMultipleTSSessions Enable (via registry_set)
id: f84139a9-a99e-564e-b2f2-32a6cb5be8e1
status: stable
description: This rule detects when the 'AllowMultipleTSSessions' value is enabled. Which enables for multiple Remote Desktop connection sessions to be opened at once. This is frequently used by adversary as a way to connect to an RDP session without disconnecting the other users
references:
    - https://attack.mitre.org/techniques/T1112/
    - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
author: Huntrule Team
date: 2026-02-04
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions'
        Details|endswith: DWORD (0x00000001)
    condition: selection
falsepositives:
    - Unknown
level: medium