RDP Enabled via Registry Modification

Attackers can enable Remote Desktop Protocol (RDP) access on Windows systems by modifying the fDenyTSConnections registry key. This technique is often employed as part of lateral movement and defense evasion strategies. By enabling RDP, adversaries can gain interactive access to compromised systems, facilitating further malicious activities such as data exfiltration, malware deployment, or privilege escalation. The modification of this registry key can be achieved through various means, including remote registry access tools like PsExec. This activity is particularly concerning because it allows attackers to blend in with legitimate remote access activities, making detection more challenging. Defenders should monitor for unauthorized or unexpected modifications to the fDenyTSConnections registry key to identify potential lateral movement attempts.

Attack Chain

1. Initial access is gained through an exploit or compromised credentials (not detailed in source).
2. The attacker leverages a tool like PsExec to execute commands remotely.
3. The attacker targets the registry key HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\fDenyTSConnections.
4. The attacker modifies the fDenyTSConnections value from 1 to 0, enabling RDP.
5. The attacker uses RDP to connect to the compromised system, establishing an interactive session.
6. The attacker performs reconnaissance, gathering information about the network and systems.
7. The attacker moves laterally to other systems using the newly enabled RDP access.
8. The attacker achieves their final objective, which could include data theft or ransomware deployment.

Impact

Successful exploitation can lead to unauthorized remote access to critical systems, allowing attackers to perform lateral movement, data exfiltration, or deploy ransomware. The lack of proper RDP security measures can significantly increase the attack surface, potentially impacting a large number of systems within the network. The modification of the fDenyTSConnections registry key can expose sensitive resources and facilitate further malicious activities, resulting in significant financial losses and reputational damage.

Recommendation

• Deploy the Sigma rule "RDP Enabled via Registry Modification" to your SIEM to detect unauthorized changes to the fDenyTSConnections registry key, as described in the rule definition.
• Enable Sysmon registry event logging to capture registry modifications for analysis and detection using the provided Sigma rule.
• Review the exclusion list in the Sigma rule "RDP Enabled via Registry Modification" and customize it for your environment to reduce false positives.
• Restrict RDP access through firewall rules, allowing only trusted hosts to connect to reduce the attack surface.
• Monitor network events for incoming RDP connection attempts following a registry modification as described in this brief.