Windows RDP Enable/Disable via Win32_TerminalServiceSetting WMI Tool Commands
Flags WMIC/PowerShell command lines that reference Win32_TerminalServiceSetting SetAllowTSConnections to change RDP.
- Product
- windows
- Category
- process_creation
- Author
- Daniel Koifman (KoifSec), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-11-15
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Lateral MovementRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions that use WMI-related command lines to change RDP access by referencing the Win32_TerminalServiceSetting class and the SetAllowTSConnections method. Attackers may use this to quickly enable or disable Remote Desktop for remote access using built-in Windows tooling such as WMIC or PowerShell. It relies on process creation telemetry, specifically the executable image names and command-line substrings that match the expected WMI alias/class and property method.
Reporting behind it
- trendmicro.comhttps://www.trendmicro.com/en_gb/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html
- github.comhttps://github.com/HackTricks-wiki/hacktricks/blob/72f20a3fa26775b932bd819f1824c6377802a768/src/windows-hardening/basic-cmd-for-pentesters.md#firewall
- github.comhttps://github.com/Lifailon/RSA/blob/rsa/Sources/RSA-1.4.1.ps1#L1468
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rdp_enable_or_disable_via_win32_terminalservicesetting_wmi_class.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows RDP Enable/Disable via Win32_TerminalServiceSetting WMI Tool Commands
id: f99a7c1e-1ba4-4459-ad0f-920e9f653946
related:
- id: a2863fbc-d5cb-48d5-83fb-d976d4b1743b
type: similar
- id: 4b8f6d3a-9c5e-4f2a-a7d8-6b9c3e5f2a8d
type: derived
status: experimental
description: This rule identifies process executions that use WMI-related command lines to change RDP access by referencing the Win32_TerminalServiceSetting class and the SetAllowTSConnections method. Attackers may use this to quickly enable or disable Remote Desktop for remote access using built-in Windows tooling such as WMIC or PowerShell. It relies on process creation telemetry, specifically the executable image names and command-line substrings that match the expected WMI alias/class and property method.
references:
- https://www.trendmicro.com/en_gb/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html
- https://github.com/HackTricks-wiki/hacktricks/blob/72f20a3fa26775b932bd819f1824c6377802a768/src/windows-hardening/basic-cmd-for-pentesters.md#firewall
- https://github.com/Lifailon/RSA/blob/rsa/Sources/RSA-1.4.1.ps1#L1468
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rdp_enable_or_disable_via_win32_terminalservicesetting_wmi_class.yml
author: Daniel Koifman (KoifSec), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-15
tags:
- attack.lateral-movement
- attack.t1021.001
- attack.execution
- attack.t1047
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \wmic.exe
- \powershell.exe
- \pwsh.exe
- OriginalFileName:
- wmic.exe
- PowerShell.EXE
- pwsh.dll
selection_cli_method:
CommandLine|contains:
- rdtoggle
- Win32_TerminalServiceSetting
selection_cli_property:
CommandLine|contains: SetAllowTSConnections
condition: all of selection_*
falsepositives:
- Legitimate system administrators enabling RDP for remote support
- System configuration scripts during deployment
level: medium
license: DRL-1.1