Query: rule covering Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a sys
Matching passage: Sigma rule: Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a sys. Logsource: windows / registry_set. Rule: title: RDP Sensitive Settings Changed to Zero id: a2863fbc-d5cb-48d5-83fb-d976d4b1743b related: - id: 3f6b7b62-61aa-45db-96bd-9c31b36b653c type: similar - id: 4b8f6d3a-9c5e-4f2a-a7d8-6b9c3e5f2a8d type: similar status: test description: 'Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the ''fAllowUnsolicited'' or enabling RDP via ''fDenyTSConnections'', etc. ' references: - https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html - http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/ - https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03 - https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html - https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/ - http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/ - https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services author: Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali date: 2022-09-29 modified: 2022-11-26 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: - \fDenyTSConnections - \fSingleSessionPerUser - \UserAuthentication Details: DWORD (0x00000000) condition: selection falsepositives: - Some of the keys mentioned here could be modified by an administrator while setting group policy (it should be investigated either way) level: medium
Near-miss passage: Sigma rule: Detect file time attribute change to hide new or changes to existing files.. Logsource: linux / auditd. Rule: title: File Time Attribute Change - Linux id: b3cec4e7-6901-4b0d-a02d-8ab2d8eb818b status: test description: Detect file time attribute change to hide new or changes to existing files. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md author: Igor Fits, oscd.community date: 2020-10-15 modified: 2022-11-28 tags: - attack.stealth - attack.t1070.006 logsource: product: linux service: auditd detection: execve: type: EXECVE touch: - touch selection2: - -t - -acmr - -d - -r condition: execve and touch and selection2 falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: Set a file's access timestamp technique: T1070.006 atomic_guid: 5f9113d5-ed75-47ed-ba23-ea3573d05810 - type: atomic-red-team name: Set a file's modification timestamp technique: T1070.006 atomic_guid: 20ef1523-8758-4898-b5a2-d026cc3d2c52 - type: atomic-red-team name: Modify file timestamps using reference file technique: T1070.006 atomic_guid: 631ea661-d661-44b0-abdb-7a7f3fc08e50