RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class
Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell. In PowerShell one-liner commands, the "SetAllowTSConnections" method of the "Win32_TerminalServiceSetting" class may be used to enable or disable RDP. In WMIC, the "rdtoggle" alias or "Win32_TerminalServiceSetting" class may be used for the same purpose.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
detection:
selection_img:
- Image|endswith:
- '\wmic.exe'
- '\powershell.exe'
- '\pwsh.exe'
- OriginalFileName:
- 'wmic.exe'
- 'PowerShell.EXE'
- 'pwsh.dll'
selection_cli_method:
CommandLine|contains:
- 'rdtoggle'
- 'Win32_TerminalServiceSetting'
selection_cli_property:
CommandLine|contains: 'SetAllowTSConnections'
condition: all of selection_*Legitimate system administrators enabling RDP for remote support
System configuration scripts during deployment
Sub-techniques