Windows Registry RDP Terminal Services Sensitive Settings Tampering

title: Windows Registry RDP Terminal Services Sensitive Settings Tampering
id: e7005648-683d-4f23-9944-0bb5b4650bae
related:
  - id: 171b67e1-74b4-460e-8d55-b331f3e32d67
    type: obsolete
  - id: 41904ebe-d56c-4904-b9ad-7a77bdf154b3
    type: obsolete
  - id: a2863fbc-d5cb-48d5-83fb-d976d4b1743b
    type: similar
  - id: 3f6b7b62-61aa-45db-96bd-9c31b36b653c
    type: derived
status: test
description: This rule identifies registry modifications related to Remote Desktop (Terminal Services) sensitive settings, including changes that can enable shadow viewing/control, allow unsolicited remote assistance offers, and alter RDP security-related options. Attackers may use these settings to weaken access controls, facilitate stealthy session interaction, or persist by configuring programs to run via remote logon automation. It relies on registry set event telemetry matching specific registry paths/values under Terminal Server/Terminal Services and related TermService parameters.
references:
  - http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/
  - http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/
  - https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services
  - https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/
  - https://blog.sekoia.io/darkgate-internals/
  - https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/
  - https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-63---disable-remote-desktop-anti-alias-setting-through-registry
  - https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-64---disable-remote-desktop-security-settings-through-registry
  - https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790
  - https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-rdp-winstationextensions-securitylayer
  - https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html
  - https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03
  - https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html
  - https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_terminal_server_tampering.yml
author: Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali, Huntrule Team
date: 2022-08-06
modified: 2025-11-22
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  category: registry_set
  product: windows
detection:
  selection_shadow:
    TargetObject|contains:
      - \Control\Terminal Server\
      - \Windows NT\Terminal Services\
    TargetObject|endswith: \Shadow
    Details:
      - DWORD (0x00000001)
      - DWORD (0x00000002)
      - DWORD (0x00000003)
      - DWORD (0x00000004)
  selection_terminal_services_key:
    TargetObject|contains:
      - \Control\Terminal Server\
      - \Windows NT\Terminal Services\
    TargetObject|endswith:
      - \DisableRemoteDesktopAntiAlias
      - \DisableSecuritySettings
      - \fAllowUnsolicited
      - \fAllowUnsolicitedFullControl
    Details: DWORD (0x00000001)
  selection_tamper_only:
    TargetObject|contains:
      - \Control\Terminal Server\InitialProgram
      - \Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram
      - \services\TermService\Parameters\ServiceDll
      - \Terminal Server\WinStations\RDP-Tcp\SecurityLayer
      - \Windows NT\Terminal Services\InitialProgram
  filter_main_securitylayer_tls:
    TargetObject|endswith: \SecurityLayer
    Details: DWORD (0x00000002)
  condition: (selection_shadow or selection_terminal_services_key or selection_tamper_only) and not 1 of filter_main_*
falsepositives:
  - Some of the keys mentioned here could be modified by an administrator while setting group policy (it should be investigated either way)
level: high
license: DRL-1.1