Default RDP Port Changed to Non-Standard Port

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•16

Detects changes to the default RDP port (3389) in the Windows Registry. Adversaries may modify the RDP port to maintain persistence or evade detection, as this change can allow them to continue using RDP for remote access on a non-standard port.