Windows reg.exe Used to Modify RDP Terminal Server Registry Values
Flags reg.exe command lines that modify Terminal Server registry values controlling RDP enablement and behavior.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- process_creation
- Author
- pH-T (Nextron Systems), @Kostastsale, TheDFIRReport (SigmaHQ), DRL 1.1
- Published
- 2022-02-12
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process execution where reg.exe is used to edit the Terminal Server registry area under CurrentControlSet\Control\Terminal Server, including specific value modifications related to RDP behavior. Such registry tampering can enable, disable, or adjust remote access settings to support persistence and lateral movement or to impair defenses. It relies on Windows process creation telemetry, specifically the executable identity (reg.exe) and the command-line strings indicating which RDP-related values are being changed, with an exclusion to reduce matches involving a specific TLS-related SecurityLayer value.
Reporting behind it
- thedfirreport.comhttps://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
- etutorials.orghttp://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/
- woshub.comhttp://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/
- admx.helphttps://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services
- bazaar.abuse.chhttps://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/
- blog.sekoia.iohttps://blog.sekoia.io/darkgate-internals/
- blog.talosintelligence.comhttps://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-63---disable-remote-desktop-anti-alias-setting-through-registry
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-64---disable-remote-desktop-security-settings-through-registry
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-rdp-winstationextensions-securitylayer
- threathunterplaybook.comhttps://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html
- twitter.comhttps://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03
- web.archive.orghttps://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html
- trendmicro.comhttps://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_rdp_keys_tamper.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-reg-exe-used-to-modify-rdp-terminal-server-registry-values-0d5675be
title: Windows reg.exe Used to Modify RDP Terminal Server Registry Values
id: 95b5b2b8-3bb9-46bf-af56-2c7496c33278
status: test
description: This rule identifies process execution where reg.exe is used to edit the Terminal Server registry area under CurrentControlSet\Control\Terminal Server, including specific value modifications related to RDP behavior. Such registry tampering can enable, disable, or adjust remote access settings to support persistence and lateral movement or to impair defenses. It relies on Windows process creation telemetry, specifically the executable identity (reg.exe) and the command-line strings indicating which RDP-related values are being changed, with an exclusion to reduce matches involving a specific TLS-related SecurityLayer value.
references:
- https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
- http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/
- http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/
- https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services
- https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/
- https://blog.sekoia.io/darkgate-internals/
- https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/
- https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-63---disable-remote-desktop-anti-alias-setting-through-registry
- https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-64---disable-remote-desktop-security-settings-through-registry
- https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790
- https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-rdp-winstationextensions-securitylayer
- https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html
- https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03
- https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html
- https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_rdp_keys_tamper.yml
author: pH-T (Nextron Systems), @Kostastsale, TheDFIRReport, Huntrule Team
date: 2022-02-12
modified: 2025-11-22
tags:
- attack.persistence
- attack.lateral-movement
- attack.defense-impairment
- attack.t1021.001
- attack.t1112
logsource:
product: windows
category: process_creation
detection:
selection_main_img:
- Image|endswith: \reg.exe
- OriginalFileName: reg.exe
selection_main_cli:
CommandLine|contains|all:
- " add "
- \CurrentControlSet\Control\Terminal Server
- REG_DWORD
- " /f"
selection_values_1:
CommandLine|contains|all:
- Licensing Core
- EnableConcurrentSessions
selection_values_2:
CommandLine|contains:
- AllowTSConnections
- fDenyTSConnections
- fEnableWinStation
- fSingleSessionPerUser
- IdleWinStationPoolCount
- MaxInstanceCount
- SecurityLayer
- TSAdvertise
- TSAppCompat
- TSEnabled
- TSUserEnabled
- WinStations\RDP-Tcp
filter_main_values_tls:
CommandLine|contains|all:
- SecurityLayer
- "02"
condition: all of selection_main_* and 1 of selection_values_* and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 0d5675be-bc88-4172-86d3-1e96a4476536
type: derived