RDP Configuration Registry Modification for Persistence

Mehulkumar Savajani@Msavajani

•updated Dec 18, 2025•48•3•404

Detects modifications to Windows Registry keys related to Remote Desktop Protocol (RDP) configuration. Malware like DarkGate is known to manipulate these settings to enable or modify RDP for persistence and remote access.