Windows Remote Services RDP Enable via Registry Modification

This analytic detects modifications in the Windows registry to enable Remote Desktop Protocol (RDP) on a targeted machine. It specifically monitors changes to the "fDenyTSConnections" registry value to "0x00000000", which indicates RDP has been enabled. This activity is significant because enabling RDP via registry is uncommon and often associated with adversaries or malware attempting to gain remote access. If confirmed malicious, this could allow attackers to remotely control the compromised host, potentially leading to further exploitation and lateral movement within the network.