Detection rules › Sigma
RDP shadow session configuration enabled (registry)
Detects scenarios where an attacker would enable shadow configuratin via registry. Note that this alert does not report the created Key and that further verification on hosts will be required to confirm the behavior.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement | T1021.001 Remote Services: Remote Desktop Protocol |
| Collection | T1113 Screen Capture, T1125 Video Capture |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 12 | RegistryEvent (Object create and delete) |
| Sysmon | Event ID 13 | RegistryEvent (Value Set) |
| Sysmon | Event ID 14 | RegistryEvent (Key and Value Rename) |
Rule body yaml
title: RDP shadow session configuration enabled (registry)
description: Detects scenarios where an attacker would enable shadow configuratin via registry. Note that this alert does not report the created Key and that further verification on hosts will be required to confirm the behavior.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0009-Collection/T1125-Video%20capture
- http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/
- https://www.elastic.co/guide/en/security/current/potential-remote-desktop-shadowing-activity.html
- https://bitsadm.in/blog/spying-on-users-using-rdp-shadowing
- https://swarm.ptsecurity.com/remote-desktop-services-shadowing/
- https://red.c3r3br4t3.com/red-team-operations/lateral-movement/shadowrdp
- https://blog.bitsadmin.com/spying-on-users-using-rdp-shadowing
tags:
- attack.lateral_movement
- attack.t1021.001 # remote services: RDP
- attack.collection
- attack.t1113 # screen capture
- attack.t1125 # video capture
author: mdecrevoisier
status: experimental
logsource:
product: windows
category: registry_event
detection: # reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v Shadow /t REG_DWORD /d 4
selection:
TargetObject|endswith: '\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
condition: selection
falsepositives:
- administrator changing RDP configuration
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
TargetObject|endswith: '\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
TargetObject | ends_with |
|