title: Changing RDP Port to Non Standard Number
id: 509e84b9-a71a-40e0-834f-05470369bd1e
description: |
  Remote desktop is a common feature in operating systems.
  It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system.
  Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).
author: frack113
date: 2022/01/01
status: experimental
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1021.001/T1021.001.md#atomic-test-1---rdp-to-domaincontroller
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        EventType: SetValue
        TargetObject: HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber
    filter:    
        Details: DWORD (0x00000d3d)
    condition: selection and not filter
falsepositives:
    - Unknown
level: high
tags:
  - attack.persistence
  - attack.t1547.010
