Detection of RDP Configuration Tampering via Reg.exe

Adversaries often use the built-in Windows utility 'reg.exe' to manipulate Remote Desktop Protocol (RDP) settings as part of post-exploitation activity. By modifying specific registry keys under 'HKLM\System\CurrentControlSet\Control\Terminal Server', threat actors can enable unauthorized remote access, disable security layers to lower defense barriers, or configure concurrent session settings to facilitate persistent remote presence. This technique has been observed across various ransomware and malware campaigns, including Qakbot, Phobos, and Gentlemen ransomware. Monitoring for these modifications is critical for detecting lateral movement and unauthorized persistence establishment within an enterprise environment.

Attack Chain

1. Attacker gains initial access or escalation of privilege on a Windows endpoint.
2. Attacker identifies target RDP configuration parameters within the registry.
3. Attacker executes 'reg.exe' via command line or automated script.
4. Attacker uses 'reg.exe add' to modify specific values under 'CurrentControlSet\Control\Terminal Server'.
5. Attacker specifies '/f' to force the registry overwrite without manual confirmation.
6. Configuration changes take effect, enabling RDP or weakening authentication/encryption security layers.
7. Attacker utilizes the altered configuration to initiate a remote session or maintain persistent access.

Impact

Successful tampering allows unauthorized remote access, bypasses intended security controls like Network Level Authentication (NLA) or TLS requirements, and assists in lateral movement. This can lead to total system compromise, exfiltration of sensitive data, and widespread ransomware deployment across the internal network.

Recommendation

Prioritize the implementation of process-creation logging to identify suspicious use of the 'reg.exe' utility.

• Deploy the provided Sigma rule to monitor for unauthorized modifications to Terminal Server registry keys.
• Establish an audit policy to alert on any modification of keys under 'HKLM\System\CurrentControlSet\Control\Terminal Server' by non-administrative service accounts or unauthorized processes.
• Review and baseline legitimate RDP configurations to differentiate between standard IT management tasks and malicious tampering attempts.