Potential Tampering With RDP Related Registry Keys Via Reg.EXE

심각도 높음 Sigma 탐지 룰. Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Termi…

작성자: pH-T (Nextron Systems), @Kostastsale, TheDFIRReport · 원본 라이선스: DRL 1.1 · SigmaHQ 원본