Tampering of RDP Terminal Services Registry Settings

Adversaries frequently target the Windows registry keys associated with Terminal Services and Remote Desktop Protocol (RDP) to gain persistent access, intercept user sessions, or impair security controls. By modifying specific configuration values under HKLM\SOFTWARE\Microsoft\Windows NT\Terminal Services or HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server, attackers can enable unauthorized shadowing, disable security layer requirements, or execute arbitrary programs upon user login. Notable threats, such as the DarkGate malware, have been observed modifying 'DisableRemoteDesktopAntiAlias' and 'DisableSecuritySettings' to facilitate their operations. Defenders must monitor these registry paths, as unauthorized modifications often indicate an attempt to bypass existing RDP security configurations or establish persistent, stealthy access to the target host.

Attack Chain

1. Attacker gains elevated administrative privileges on the target Windows system.
2. Attacker locates the sensitive registry keys under HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server or HKLM\SOFTWARE\Microsoft\Windows NT\Terminal Services.
3. Attacker modifies the 'ServiceDll' value to perform RDP hijacking by specifying a malicious custom DLL.
4. Attacker adjusts 'DisableSecuritySettings' or 'DisableRemoteDesktopAntiAlias' to weaken RDP connection requirements.
5. Attacker enables RDP 'Shadow' keys to view or control active user sessions without authorization.
6. Attacker configures the 'InitialProgram' key to execute a malicious payload automatically upon the next remote session login.
7. Attacker initiates an RDP connection to the compromised host using the newly established persistent or stealthy access configuration.

Impact

Successful manipulation of RDP registry settings enables adversaries to maintain persistence, conduct credential harvesting via session monitoring, move laterally within an environment, and disable security layers that protect remote access, potentially leading to full system compromise and data exfiltration.

Recommendation

• Deploy the Sigma rule below to detect unauthorized modifications to sensitive Terminal Services registry keys.
• Enable Sysmon registry-set logging (Event ID 13) to capture changes to the defined registry paths.
• Investigate any alerts originating from legitimate administrative activity to distinguish between authorized group policy updates and potential malicious tampering.
• Establish a baseline for RDP configuration and alert on deviations, particularly for keys related to 'Shadow' and 'ServiceDll'.