Detection of Registry-Based RDP Disablement

Adversaries, notably the ShrinkLocker ransomware, frequently target the Windows Registry to impede incident response and remote management. By modifying the "fDenyTSConnections" value within the Terminal Server control key, attackers can effectively disable Remote Desktop Protocol (RDP) access. Setting this registry value to '1' prevents remote administrative sessions, which is a common tactic to isolate infected systems, evade live response, and disrupt automated remediation efforts. This modification is typically observed during the late stages of an attack chain when the adversary seeks to finalize their control over the endpoint or secure their presence before performing destructive actions such as file encryption.

Attack Chain

1. Attacker gains administrative or system-level privileges on the target host.
2. Attacker prepares for final-stage impact (e.g., ransomware deployment).
3. Attacker identifies the target registry path: HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server.
4. Attacker writes to the "fDenyTSConnections" registry value using command-line tools like reg.exe or PowerShell.
5. Registry modification completes, immediately disabling incoming RDP connections.
6. RDP service remains running, but the OS policy blocks all new network-based remote login attempts.
7. Attacker proceeds with the primary objective (e.g., encryption, exfiltration, or persistence).

Impact

Successful modification of the "fDenyTSConnections" key results in the loss of remote administrative capability. This forces incident responders to rely on physical access or out-of-band management tools to remediate the system. When part of a ransomware attack like ShrinkLocker, this isolation prevents security teams from quickly terminating processes, dumping memory for analysis, or retrieving logs from the infected host.

Recommendation

• Deploy the provided Sigma rule to monitor for registry modifications targeting the "fDenyTSConnections" key.
• Enable Sysmon Event ID 13 (Registry Event) across all endpoints to ensure visibility into registry modifications.
• Baseline legitimate administrative activity regarding RDP management to reduce false positives generated by system administrators.
• Use the resulting alerts to trigger immediate investigation of the process responsible for the modification and the user context involved.