title: Enabling RDP Service via Reg.exe
id: 0d5675be-bc88-4172-86d3-1e96a4476536
status: experimental
description: Detects the execution of reg.exe and subsequent command line arguments for enabling RDP service on the host 
author: '@Kostastsale, @TheDFIRReport, slightly modified by pH-T'
references:
  - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
date: 2022/02/12
modified: 2022/03/15
logsource:
  product: windows
  category: process_creation
detection:
  selection1:
    Image|endswith: '\reg.exe'
    CommandLine|contains|all:
      - ' add '
      - '\SYSTEM\CurrentControlSet\Control\Terminal Server'
      - 'REG_DWORD'
      - ' /f'
  selection2:
    CommandLine|contains|all:
      - 'Licensing Core'
      - 'EnableConcurrentSessions'
  selection3:
    CommandLine|contains:
      - 'WinStations\RDP-Tcp'
      - 'MaxInstanceCount'
      - 'fEnableWinStation'
      - 'TSUserEnabled'
      - 'TSEnabled'
      - 'TSAppCompat'
      - 'IdleWinStationPoolCount'
      - 'TSAdvertise'
      - 'AllowTSConnections'
      - 'fSingleSessionPerUser'
  condition: selection1 and (selection2 or selection3)
falsepositives:
  - Unknown
level: high
tags:
  - attack.defense_evasion
  - attack.lateral_movement
  - attack.t1021.001
  - attack.t1112
