name: Windows Remote Services Rdp Enable
id: 8fbd2e88-4ea5-40b9-9217-fd0855e08cc0
version: 1
date: '2022-06-21'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic is to identify a modification in the Windows registry
  to enable remote desktop protocol on a targeted machine. This technique was seen
  in several adversaries, malware or red teamer to remotely access the compromised
  or targeted host by enabling this protocol in registry. Even this protocol might
  be allowed in some production environment, This TTP behavior is a good pivot to
  check who and why the user want to enable this feature through registry which is
  un-common.
data_source:
- Sysmon Event ID 13
search:
  selection1:
    Details: '0x00000000'
    TargetObject: '*\\Control\\Terminal Server\\fDenyTSConnections*'
  condition: selection1
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
  that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: administrators may enable or disable this feature that may
  cause some false positive.
references:
- https://www.hybrid-analysis.com/sample/9d6611c2779316f1ef4b4a6edcfdfb5e770fe32b31ec2200df268c3bd236ed75?environmentId=100
tags:
  analytic_story:
  - Azorult
  asset_type: Endpoint
  confidence: 70
  impact: 70
  message: the registry for rdp protocol was modified to enable in $dest$
  mitre_attack_id:
  - T1021.001
  - T1021
  observable:
  - name: dest
    type: Endpoint
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 49
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog
    update_timestamp: true