Detectionmediumtest

Allow RDP Remote Assistance Feature

Detect enable rdp feature to allow specific user to rdp connect on the targeted machine

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

François HubautCreated Fri Aug 19Updated Thu Aug 1737b437cf-3fc5-4c8e-9c94-1d7c9aff842bwindows

Log Source

WindowsRegistry Set

ProductWindows← raw: windows

CategoryRegistry Set← raw: registry_set

Detection Logic

detection:
    selection:
        TargetObject|endswith: 'System\CurrentControlSet\Control\Terminal Server\fAllowToGetHelp'
        Details: DWORD (0x00000001)
    condition: selection

False Positives

Legitimate use of the feature (alerts should be investigated either way)

References

Resolving title…

github.com

Testing & Validation

Simulations

atomic-red-teamT1112

View on ART

Allow RDP Remote Assistance Feature

GUID: 86677d0e-0b5e-4a2b-b302-454175f9aa9e

Regression Tests

by SigmaHQ Team

Positive Detection Test1 matchevtx

Microsoft-Windows-Sysmon

EVTX JSON

MITRE ATT&CK

Tactics

TA0003 · Persistence TA0005 · Defense Evasion

Techniques

T1112 · Modify Registry

Rule Metadata

Rule ID

37b437cf-3fc5-4c8e-9c94-1d7c9aff842b

Status

test

Level

medium

Type

Detection

Created

Fri Aug 19

Modified

Thu Aug 17

Author

François Hubaut

Path

rules/windows/registry/registry_set/registry_set_allow_rdp_remote_assistance_feature.yml

Raw Tags

attack.persistenceattack.defense-evasionattack.t1112

View on GitHub