Query: Sigma rule for Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a sys
Matching passage: Sigma rule: Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a sys. Logsource: windows / registry_set. Rule: title: RDP Sensitive Settings Changed id: 3f6b7b62-61aa-45db-96bd-9c31b36b653c related: - id: 171b67e1-74b4-460e-8d55-b331f3e32d67 type: obsolete - id: 41904ebe-d56c-4904-b9ad-7a77bdf154b3 type: obsolete - id: a2863fbc-d5cb-48d5-83fb-d976d4b1743b type: similar status: test description: 'Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the ''fAllowUnsolicited'' or enabling RDP via ''fDenyTSConnections'', etc. Below is a list of registry keys/values that are monitored by this rule: - Shadow: Used to enable Remote Desktop shadowing, which allows an administrator to view or control a user''s session. - DisableRemoteDesktopAntiAlias: Disables anti-aliasing for remote desktop sessions. - DisableSecuritySettings: Disables certain security settings for Remote Desktop connections. - fAllowUnsolicited: Allows unsolicited remote assistance offers. - fAllowUnsolicitedFullControl: Allows unsolicited remote assistance offers with full control. - InitialProgram: Specifies a program to run automatically when a user logs on to a remote computer. - ServiceDll: Used in RDP hijacking techniques to specify a custom DLL to be loaded by the Terminal Services service. - SecurityLayer: Specifies the security layer used for RDP connections. ' references: - http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/ - http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/ - https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services - https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/ - https://blog.sekoia.io/darkgate-internals/ - https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/ - https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-63---disable-remote-desktop-anti-alias-setting-through-registry - https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-64---disable-remote-desktop-security-settings-through-registry - https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790 - https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalser
Near-miss passage: Sigma rule: Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking.. Logsource: windows / security. Rule: title: Weak Encryption Enabled and Kerberoast id: f6de9536-0441-4b3f-a646-f4e00f300ffd status: test description: Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking. references: - https://adsecurity.org/?p=2053 - https://blog.harmj0y.net/redteaming/another-word-on-delegation/ author: '@neu5ron' date: 2017-07-30 modified: 2021-11-27 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: security definition: 'Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management' detection: selection: EventID: 4738 olduac_des: OldUacValue|endswith: - 8??? - 9??? - A??? - B??? - C??? - D??? - E??? - F??? newuac_des: NewUacValue|endswith: - 8??? - 9??? - A??? - B??? - C??? - D??? - E??? - F??? olduac_preauth: OldUacValue|endswith: - 1???? - 3???? - 5???? - 7???? - 9???? - B???? - D???? - F???? newuac_preauth: NewUacValue|endswith: - 1???? - 3???? - 5???? - 7???? - 9???? - B???? - D???? - F???? olduac_encrypted: OldUacValue|endswith: - 8?? - 9?? - A?? - B?? - C?? - D?? - E?? - F?? newuac_encrypted: NewUacValue|endswith: - 8?? - 9?? - A?? - B?? - C?? - D?? - E?? - F?? condition: selection and ((newuac_des and not olduac_des) or (newuac_preauth and not olduac_preauth) or (newuac_encrypted and not olduac_encrypted)) falsepositives: - Unknown level: high