Default RDP Port Changed to Non Standard Port

calendar Mar 26, 2024 · attack.persistence attack.t1547.010  ·
Share on: linkedin copy

Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).

Sigma rule (View on GitHub)

 1title: Default RDP Port Changed to Non Standard Port
 2id: 509e84b9-a71a-40e0-834f-05470369bd1e
 3status: test
 4description: |
 5    Detects changes to the default RDP port.
 6    Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface.
 7    Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).    
 8references:
 9    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md#atomic-test-1---rdp-to-domaincontroller
10author: frack113
11date: 2022/01/01
12modified: 2024/03/25
13tags:
14    - attack.persistence
15    - attack.t1547.010
16logsource:
17    category: registry_set
18    product: windows
19detection:
20    selection:
21        TargetObject|endswith: '\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber'
22    filter_main_port:
23        Details: DWORD (0x00000d3d) # 3389
24    condition: selection and not 1 of filter_main_*
25falsepositives:
26    - Unknown
27level: high

References

Related rules

to-top