Potential Tampering With RDP Related Registry Keys Via Reg.EXE

Google SecOps@GoogleSecOps

•updated Jun 6, 2025•0•0•0

Detects the execution of reg.exe for enabling/disabling the RDP service on the host by tampering with the CurrentControlSet\\Control\\Terminal Server values