From 3d69727332022bf0d03a7ca2dfc07a3a67a8fbb6 Mon Sep 17 00:00:00 2001
From: sbousseaden <bousseaden.samir@gmail.com>
Date: Wed, 3 Apr 2019 14:16:25 +0200
Subject: [PATCH] Create sysmon_rdp_settings_hijack.yml

---
 .../sysmon/sysmon_rdp_settings_hijack.yml     | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 rules/windows/sysmon/sysmon_rdp_settings_hijack.yml

diff --git a/rules/windows/sysmon/sysmon_rdp_settings_hijack.yml b/rules/windows/sysmon/sysmon_rdp_settings_hijack.yml
new file mode 100644
index 000000000..1f02ec856
--- /dev/null
+++ b/rules/windows/sysmon/sysmon_rdp_settings_hijack.yml
@@ -0,0 +1,22 @@
+title: RDP Sensitive Settings Changed
+description: Detects changes to RDP terminal service sensitive settings
+references:
+    - https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html
+date: 2019/04/03
+author: Samir Bousseaden
+logsource:
+   product: windows
+   service: sysmon
+detection:
+    selection_reg:
+        EventID: 13 
+        TargetObject: 
+            - '*\services\TermService\Parameters\ServiceDll*'
+            - '*\Control\Terminal Server\fSingleSessionPerUser*'
+            - '*\Control\Terminal Server\fDenyTSConnections*'
+    condition: selection_reg
+tags:
+    - attack.defense_evasion
+falsepositives:
+    - unknown
+level: high