Detectionmediumexperimental

RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class

Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell. In PowerShell one-liner commands, the "SetAllowTSConnections" method of the "Win32_TerminalServiceSetting" class may be used to enable or disable RDP. In WMIC, the "rdtoggle" alias or "Win32_TerminalServiceSetting" class may be used for the same purpose.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Daniel Koifman (KoifSec), Swachchhanda Shrawan Poudel (Nextron Systems)Created Sat Nov 154b8f6d3a-9c5e-4f2a-a7d8-6b9c3e5f2a8dwindows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic3 selectors
detection:
    selection_img:
        - Image|endswith:
              - '\wmic.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'wmic.exe'
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_cli_method:
        CommandLine|contains:
            - 'rdtoggle'
            - 'Win32_TerminalServiceSetting'
    selection_cli_property:
        CommandLine|contains: 'SetAllowTSConnections'
    condition: all of selection_*
False Positives

Legitimate system administrators enabling RDP for remote support

System configuration scripts during deployment

Rule Metadata
Rule ID
4b8f6d3a-9c5e-4f2a-a7d8-6b9c3e5f2a8d
Status
experimental
Level
medium
Type
Detection
Created
Sat Nov 15
Path
rules/windows/process_creation/proc_creation_win_rdp_enable_or_disable_via_win32_terminalservicesetting_wmi_class.yml
Raw Tags
attack.lateral-movementattack.t1021.001attack.executionattack.t1047
View on GitHub