Windows reg.exe Used to Modify RDP Terminal Server Registry Values

title: Windows reg.exe Used to Modify RDP Terminal Server Registry Values
id: 95b5b2b8-3bb9-46bf-af56-2c7496c33278
status: test
description: This rule identifies process execution where reg.exe is used to edit the Terminal Server registry area under CurrentControlSet\Control\Terminal Server, including specific value modifications related to RDP behavior. Such registry tampering can enable, disable, or adjust remote access settings to support persistence and lateral movement or to impair defenses. It relies on Windows process creation telemetry, specifically the executable identity (reg.exe) and the command-line strings indicating which RDP-related values are being changed, with an exclusion to reduce matches involving a specific TLS-related SecurityLayer value.
references:
  - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
  - http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/
  - http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/
  - https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services
  - https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/
  - https://blog.sekoia.io/darkgate-internals/
  - https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/
  - https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-63---disable-remote-desktop-anti-alias-setting-through-registry
  - https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-64---disable-remote-desktop-security-settings-through-registry
  - https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790
  - https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-rdp-winstationextensions-securitylayer
  - https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html
  - https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03
  - https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html
  - https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_rdp_keys_tamper.yml
author: pH-T (Nextron Systems), @Kostastsale, TheDFIRReport, Huntrule Team
date: 2022-02-12
modified: 2025-11-22
tags:
  - attack.persistence
  - attack.lateral-movement
  - attack.defense-impairment
  - attack.t1021.001
  - attack.t1112
logsource:
  product: windows
  category: process_creation
detection:
  selection_main_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_main_cli:
    CommandLine|contains|all:
      - " add "
      - \CurrentControlSet\Control\Terminal Server
      - REG_DWORD
      - " /f"
  selection_values_1:
    CommandLine|contains|all:
      - Licensing Core
      - EnableConcurrentSessions
  selection_values_2:
    CommandLine|contains:
      - AllowTSConnections
      - fDenyTSConnections
      - fEnableWinStation
      - fSingleSessionPerUser
      - IdleWinStationPoolCount
      - MaxInstanceCount
      - SecurityLayer
      - TSAdvertise
      - TSAppCompat
      - TSEnabled
      - TSUserEnabled
      - WinStations\RDP-Tcp
  filter_main_values_tls:
    CommandLine|contains|all:
      - SecurityLayer
      - "02"
  condition: all of selection_main_* and 1 of selection_values_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 0d5675be-bc88-4172-86d3-1e96a4476536
    type: derived