Create sysmon_rdp_settings_hijack.yml

2019-04-03 14:16:25 +02:00
parent 016261cacf
commit 3d69727332
1 changed files with 22 additions and 0 deletions
@@ -0,0 +1,22 @@
+title: RDP Sensitive Settings Changed
+description: Detects changes to RDP terminal service sensitive settings
+references:
+    - https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html
+date: 2019/04/03
+author: Samir Bousseaden
+logsource:
+   product: windows
+   service: sysmon
+detection:
+    selection_reg:
+        EventID: 13 
+        TargetObject: 
+            - '*\services\TermService\Parameters\ServiceDll*'
+            - '*\Control\Terminal Server\fSingleSessionPerUser*'
+            - '*\Control\Terminal Server\fDenyTSConnections*'
+    condition: selection_reg
+tags:
+    - attack.defense_evasion
+falsepositives:
+    - unknown
+level: high