Multiple RDP sessions enabled via Registry

BIOC Medium

Multiple RDP sessions enabled via Registry

Attackers may allow multiple RDP sessions, so they could access the machine at the same time the user does.

Module:: Platform Analytics
Agent event type:: Registry
Category:: Persistence
Status:: Enabled

ATT&CK tactics: Persistence (TA0003) Lateral Movement (TA0008)

ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001) Create or Modify System Process: Windows Service (T1543.003)

Indicator:

Registry registry key name = HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Terminal Server AND registry value name = fSingleSessionsPerUser AND action type = set_registry_value Host host os = windows

Preventable: yes