Query: write Sigma for Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a sys
Matching passage: Sigma rule: Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a sys. Logsource: windows / registry_set. Rule: title: RDP Sensitive Settings Changed id: 3f6b7b62-61aa-45db-96bd-9c31b36b653c related: - id: 171b67e1-74b4-460e-8d55-b331f3e32d67 type: obsolete - id: 41904ebe-d56c-4904-b9ad-7a77bdf154b3 type: obsolete - id: a2863fbc-d5cb-48d5-83fb-d976d4b1743b type: similar status: test description: 'Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the ''fAllowUnsolicited'' or enabling RDP via ''fDenyTSConnections'', etc. Below is a list of registry keys/values that are monitored by this rule: - Shadow: Used to enable Remote Desktop shadowing, which allows an administrator to view or control a user''s session. - DisableRemoteDesktopAntiAlias: Disables anti-aliasing for remote desktop sessions. - DisableSecuritySettings: Disables certain security settings for Remote Desktop connections. - fAllowUnsolicited: Allows unsolicited remote assistance offers. - fAllowUnsolicitedFullControl: Allows unsolicited remote assistance offers with full control. - InitialProgram: Specifies a program to run automatically when a user logs on to a remote computer. - ServiceDll: Used in RDP hijacking techniques to specify a custom DLL to be loaded by the Terminal Services service. - SecurityLayer: Specifies the security layer used for RDP connections. ' references: - http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/ - http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/ - https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services - https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/ - https://blog.sekoia.io/darkgate-internals/ - https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/ - https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-63---disable-remote-desktop-anti-alias-setting-through-registry - https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-64---disable-remote-desktop-security-settings-through-registry - https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790 - https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalser
Near-miss passage: Sigma rule: Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line argume. Logsource: windows / process_creation. Rule: title: HackTool - SOAPHound Execution id: e92a4287-e072-4a40-9739-370c106bb750 status: test description: 'Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information. ' references: - https://github.com/FalconForceTeam/SOAPHound - https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c author: '@kostastsale' date: 2024-01-26 tags: - attack.discovery - attack.t1087 logsource: product: windows category: process_creation detection: selection_1: CommandLine|contains: - ' --buildcache ' - ' --bhdump ' - ' --certdump ' - ' --dnsdump ' selection_2: CommandLine|contains: - ' -c ' - ' --cachefilename ' - ' -o ' - ' --outputdirectory' condition: all of selection_* falsepositives: - Unknown level: high