Title:Default RDP Port Changed to Non Standard Port Status:test Description:Detects changes to the default RDP port.
Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface.
Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).
References: -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md Author: frack113 Date: 2022-01-01 modified:2024-03-25 Tags:
-'attack.privilege-escalation'
-'attack.persistence'
-'attack.t1547.010'
Logsource:
category: registry_set
product: windows
Detection: selection: TargetObject|endswith:
'\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber' filter_main_port: Details:
'DWORD (0x00000d3d)' condition:selection and not 1 of filter_main_* Falsepositives:
-Unknown Level:high
