Windows RDP Enable/Disable via Win32_TerminalServiceSetting WMI Tool Commands

Flags WMIC/PowerShell command lines that reference Win32_TerminalServiceSetting SetAllowTSConnections to change RDP.

FreeUnreviewedSigmamediumv1

windows-rdp-enable-disable-via-win32-terminalservicesetting-wmi-tool-commands-4b8f6d3a

title: Windows RDP Enable/Disable via Win32_TerminalServiceSetting WMI Tool Commands
id: f99a7c1e-1ba4-4459-ad0f-920e9f653946
related:
  - id: a2863fbc-d5cb-48d5-83fb-d976d4b1743b
    type: similar
  - id: 4b8f6d3a-9c5e-4f2a-a7d8-6b9c3e5f2a8d
    type: derived
status: experimental
description: This rule identifies process executions that use WMI-related command lines to change RDP access by referencing the Win32_TerminalServiceSetting class and the SetAllowTSConnections method. Attackers may use this to quickly enable or disable Remote Desktop for remote access using built-in Windows tooling such as WMIC or PowerShell. It relies on process creation telemetry, specifically the executable image names and command-line substrings that match the expected WMI alias/class and property method.
references:
  - https://www.trendmicro.com/en_gb/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html
  - https://github.com/HackTricks-wiki/hacktricks/blob/72f20a3fa26775b932bd819f1824c6377802a768/src/windows-hardening/basic-cmd-for-pentesters.md#firewall
  - https://github.com/Lifailon/RSA/blob/rsa/Sources/RSA-1.4.1.ps1#L1468
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rdp_enable_or_disable_via_win32_terminalservicesetting_wmi_class.yml
author: Daniel Koifman (KoifSec), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-15
tags:
  - attack.lateral-movement
  - attack.t1021.001
  - attack.execution
  - attack.t1047
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \wmic.exe
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - wmic.exe
        - PowerShell.EXE
        - pwsh.dll
  selection_cli_method:
    CommandLine|contains:
      - rdtoggle
      - Win32_TerminalServiceSetting
  selection_cli_property:
    CommandLine|contains: SetAllowTSConnections
  condition: all of selection_*
falsepositives:
  - Legitimate system administrators enabling RDP for remote support
  - System configuration scripts during deployment
level: medium
license: DRL-1.1

What it detects

This rule identifies process executions that use WMI-related command lines to change RDP access by referencing the Win32_TerminalServiceSetting class and the SetAllowTSConnections method. Attackers may use this to quickly enable or disable Remote Desktop for remote access using built-in Windows tooling such as WMIC or PowerShell. It relies on process creation telemetry, specifically the executable image names and command-line substrings that match the expected WMI alias/class and property method.

Known false positives

Legitimate system administrators enabling RDP for remote support
System configuration scripts during deployment

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.