admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update windows_remote_services_allow_remote_assistance.yml

Browse Source
This commit is contained in:
tccontre
2022-07-05 15:37:46 +02:00
committed by GitHub
parent 16a9e7c3af
commit 8a95bfd0b8
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_remote_services_allow_remote_assistance.yml
+1 -1
View File
@@ -7,7 +7,7 @@ type: Anomaly
datamodel:
- Endpoint
description: The following analytic is to identify a modification in the Windows registry
to enable remoted desktop assitance on a targeted machine. This technique was seen in several adversaries, malware or red teamer
to enable remote desktop assitance on a targeted machine. This technique was seen in several adversaries, malware or red teamer
like azorult to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some
production environment, This Anomaly behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common.
And as per stated in microsoft documentation the default value of this registry is false that makes this a good indicator of suspicious behavior.