Potential Tampering With RDP Related Registry Keys Via Reg.EXE

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•14

This rule detects attempts to modify Remote Desktop Protocol (RDP) related registry keys using the `reg.exe` utility. Specifically, it looks for command-line executions of `reg.exe` that add or modify values within the `CurrentControlSet\Control\Terminal Server` registry path. The rule targets modifications related to RDP licensing, concurrent sessions, WinStation configurations (like `MaxInstanceCount`, `fEnableWinStation`, `TSUserEnabled`, `TSEnabled`, `TSAppCompat`, `IdleWinStationPoolCount`, `TSAdvertise`, `AllowTSConnections`, `fSingleSessionPerUser`, `fDenyTSConnections`), which could indicate an adversary enabling or reconfiguring RDP for persistence, lateral movement, or defense evasion.