Default RDP Port Changed to Non Standard Port

calendar Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.010  ·
Share on: linkedin copy

Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).

Sigma rule (View on GitHub)

 1title: Default RDP Port Changed to Non Standard Port
 2id: 509e84b9-a71a-40e0-834f-05470369bd1e
 3status: test
 4description: |
 5    Detects changes to the default RDP port.
 6    Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface.
 7    Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).    
 8references:
 9    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md#atomic-test-1---rdp-to-domaincontroller
10author: frack113
11date: 2022-01-01
12modified: 2024-03-25
13tags:
14    - attack.privilege-escalation
15    - attack.persistence
16    - attack.t1547.010
17logsource:
18    category: registry_set
19    product: windows
20detection:
21    selection:
22        TargetObject|endswith: '\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber'
23    filter_main_port:
24        Details: DWORD (0x00000d3d) # 3389
25    condition: selection and not 1 of filter_main_*
26falsepositives:
27    - Unknown
28level: high

References

Related rules

to-top