RDP connections enabled remotely via Registry

Cortex XDR Analytics Alert Reference by Alert name

Product
Cortex XDR
Last date published
2024-11-06
Category
Analytics Alert Reference
Order
Alert name

Synopsis

Activation Period

14 Days

Training Period

30 Days

Test Period

N/A (single event)

Deduplication Period

1 Day

Required Data

  • Requires:
    • XDR Agent with eXtended Threat Hunting (XTH)

Detection Modules

Detector Tags

ATT&CK Tactic

Lateral Movement (TA0008)

ATT&CK Technique

Remote Services: Remote Desktop Protocol (T1021.001)

Severity

Low

Description

An attacker may remotely enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0.

Attacker's Goals

Remotely enable RDP on the host for lateral movement.

Investigative actions

  • Check whether the executing process is benign, and if this was a desired behavior as part of its normal execution flow.
  • Search for RDP sessions to this host and investigate them for malicious activities.

Variations

RDP connections enabled by a remote process via Registry

Synopsis

ATT&CK Tactic

Lateral Movement (TA0008)

ATT&CK Technique

Remote Services: Remote Desktop Protocol (T1021.001)

Severity

Low

Description

An attacker may remotely enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0.

Attacker's Goals

Remotely enable RDP on the host for lateral movement.

Investigative actions

  • Check whether the executing process is benign, and if this was a desired behavior as part of its normal execution flow.
  • Search for RDP sessions to this host and investigate them for malicious activities.


RDP connections enabled remotely via Registry using WinRM

Synopsis

ATT&CK Tactic

Lateral Movement (TA0008)

ATT&CK Technique

Severity

Low

Description

An attacker may remotely enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0.

Attacker's Goals

Remotely enable RDP on the host for lateral movement.

Investigative actions

  • Check whether the executing process is benign, and if this was a desired behavior as part of its normal execution flow.
  • Search for RDP sessions to this host and investigate them for malicious activities.