Suspicious RDP Configuration Changes via Registry and Netsh

Rudra Verma@Rudraverma

•updated Feb 19, 2026•18•1•8,847

This rule detects suspicious modifications to Remote Desktop Protocol (RDP) configurations via `reg.exe` and `netsh.exe`. Specifically, it looks for attempts to enable RDP by setting `fDenyTSConnections` to 0, modify the `UserAuthentication` setting in `RDP-Tcp` to 0, or add a firewall rule to allow RDP traffic on port 3389. These actions can indicate an adversary attempting to establish or facilitate remote access to a system.