diff --git a/rules/windows/sysmon/sysmon_rdp_settings_hijack.yml b/rules/windows/sysmon/sysmon_rdp_settings_hijack.yml
new file mode 100644
index 000000000..1f02ec856
--- /dev/null
+++ b/rules/windows/sysmon/sysmon_rdp_settings_hijack.yml
@@ -0,0 +1,22 @@
+title: RDP Sensitive Settings Changed
+description: Detects changes to RDP terminal service sensitive settings
+references:
+    - https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html
+date: 2019/04/03
+author: Samir Bousseaden
+logsource:
+   product: windows
+   service: sysmon
+detection:
+    selection_reg:
+        EventID: 13 
+        TargetObject: 
+            - '*\services\TermService\Parameters\ServiceDll*'
+            - '*\Control\Terminal Server\fSingleSessionPerUser*'
+            - '*\Control\Terminal Server\fDenyTSConnections*'
+    condition: selection_reg
+tags:
+    - attack.defense_evasion
+falsepositives:
+    - unknown
+level: high