Rdp Registry Modification Via Command Line

Rohan Taluja@cypher01

•updated Apr 15, 2026•1•0•619

Detects command line execution attempting to modify fDenyTSConnections registry value via reg add — used by attackers to enable RDP for lateral movement