RDP Sensitive Settings Changed to Zero

Google SecOps@GoogleSecOps

•updated Jun 25, 2025•0•47

Detects tampering of RDP Terminal Service/Server sensitive settings by monitoring modifications to specific registry keys. This includes changes that could allow unauthorized users access via 'fAllowUnsolicited', or enabling RDP via 'fDenyTSConnections' by setting their values to 'DWORD (0x00000000)'.