RDP Sensitive Settings Changed

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

Detects tampering of RDP Terminal Service/Server sensitive settings. This includes modifications to allow unsolicited remote assistance, disable security settings, or enable RDP via specific registry keys. It also covers changes related to RDP hijacking via the 'ServiceDll' key and the 'Shadow' RDP technique.