RDP Sensitive Settings Changed to Zero

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

Detects tampering of RDP Terminal Service/Server sensitive settings by monitoring changes to specific registry keys. This includes scenarios such as enabling RDP connections, allowing multiple RDP sessions per user, or disabling Network-Level Authentication (NLA) by setting the relevant registry values to '0'. Such modifications can facilitate unauthorized access or RDP hijacking.