Default RDP Port Changed to Non-Standard Port
This rule detects changes to the Windows Registry key that controls the Remote Desktop Protocol (RDP) port number. Specifically, it triggers when the RDP port is modified from its default value of 3389 to any other port. This activity can be indicative of an adversary attempting to evade detection, bypass network filtering, or maintain persistence by configuring RDP to listen on a non-standard port.
YARA-L
