Query: write Sigma for Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentCont
Matching passage: Sigma rule: Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentCont. Logsource: windows / process_creation. Rule: title: Potential Tampering With RDP Related Registry Keys Via Reg.EXE id: 0d5675be-bc88-4172-86d3-1e96a4476536 status: test description: Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values references: - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/ - http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/ - http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/ - https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services - https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/ - https://blog.sekoia.io/darkgate-internals/ - https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/ - https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-63---disable-remote-desktop-anti-alias-setting-through-registry - https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-64---disable-remote-desktop-security-settings-through-registry - https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790 - https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-rdp-winstationextensions-securitylayer - https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html - https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03 - https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html - https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html author: pH-T (Nextron Systems), @Kostastsale, TheDFIRReport date: 2022-02-12 modified: 2025-11-22 tags: - attack.persistence - attack.lateral-movement - attack.defense-impairment - attack.t1021.001 - attack.t1112 logsource: product: windows category: process_creation detection: selection_main_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_main_cli: CommandLine|contains|all: - ' add ' - \CurrentControlSet\Control\Terminal Server - REG_DWORD - ' /f' selection_values_1:
Near-miss passage: Sigma rule: Detects programs that connect to uncommon destination ports. Logsource: windows / network_connection. Rule: title: Communication To Uncommon Destination Ports id: 6d8c3d20-a5e1-494f-8412-4571d716cf5c related: - id: 4b89abaa-99fe-4232-afdd-8f9aa4d20382 type: similar status: test description: Detects programs that connect to uncommon destination ports references: - https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo author: Florian Roth (Nextron Systems) date: 2017-03-19 modified: 2024-03-12 tags: - attack.persistence - attack.command-and-control - attack.t1571 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationPort: - 8080 - 8888 filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 filter_optional_sys_directories: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium