RDP shadow session configuration enabled (registry)

Status: experimental
Severity: high
Log source: category registry_event, product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker would enable shadow configuratin via registry. Note that this alert does not report the created Key and that further verification on hosts will be required to confirm the behavior.

Known false positives

administrator changing RDP configuration

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1021.001` Remote Services: Remote Desktop Protocol
Collection	`T1113` Screen Capture `T1125` Video Capture

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 12: RegistryEvent (Object create and delete)
Sysmon	Event ID 13: RegistryEvent (Value Set)
Sysmon	Event ID 14: RegistryEvent (Key and Value Rename)

Rule body

title: RDP shadow session configuration enabled (registry)
description: Detects scenarios where an attacker would enable shadow configuratin via registry. Note that this alert does not report the created Key and that further verification on hosts will be required to confirm the behavior.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0009-Collection/T1125-Video%20capture
- http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/
- https://www.elastic.co/guide/en/security/current/potential-remote-desktop-shadowing-activity.html
- https://bitsadm.in/blog/spying-on-users-using-rdp-shadowing
- https://swarm.ptsecurity.com/remote-desktop-services-shadowing/
- https://red.c3r3br4t3.com/red-team-operations/lateral-movement/shadowrdp
- https://blog.bitsadmin.com/spying-on-users-using-rdp-shadowing
tags:
- attack.lateral_movement
- attack.t1021.001 # remote services: RDP
- attack.collection
- attack.t1113 # screen capture
- attack.t1125 # video capture
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: registry_event
detection: # reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v Shadow /t REG_DWORD /d 4
  selection:
    TargetObject|endswith: '\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
  condition: selection
falsepositives:
- administrator changing RDP configuration
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  TargetObject|endswith: '\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetObject`	ends_with	`\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services`	`field:"TargetObject" kind:ends_with value:"\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"`