Default RDP Port Changed to Non Standard Port

 1title: Default RDP Port Changed to Non Standard Port
 2id: 509e84b9-a71a-40e0-834f-05470369bd1e
 3status: test
 4description: |
 5    Detects changes to the default RDP port.
 6    Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface.
 7    Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).    
 8references:
 9    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md
10author: frack113
11date: 2022-01-01
12modified: 2024-03-25
13tags:
14    - attack.privilege-escalation
15    - attack.persistence
16    - attack.t1547.010
17logsource:
18    category: registry_set
19    product: windows
20detection:
21    selection:
22        TargetObject|endswith: '\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber'
23    filter_main_port:
24        Details: DWORD (0x00000d3d) # 3389
25    condition: selection and not 1 of filter_main_*
26falsepositives:
27    - Unknown
28level: high
29regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_change_rdp_port/info.yml
30simulation:
31    - type: atomic-red-team
32      name: Changing RDP Port to Non Standard Port via Powershell
33      technique: T1021.001
34      atomic_guid: 2f840dd4-8a2e-4f44-beb3-6b2399ea3771
35    - type: atomic-red-team
36      name: Changing RDP Port to Non Standard Port via Command_Prompt
37      technique: T1021.001
38      atomic_guid: 74ace21e-a31c-4f7d-b540-53e4eb6d1f73