Know Your Adversary

Hello everyone! I'm sure you know that adversaries LOVE RDP. In most cases they use it for lateral movement. Today we'll look at the following technique:  Server Software Component: Terminal Services DLL (T1505.005) . According to this report on Crypto24 ransomware group, the adversary patched termsrv.dll to enable multiple simultaneous RDP connections. The threat actor also executed the following commands related to the DLL: takeown.exe /F C:\Windows\System32\termsrv.dll /A icacls.exe C:\Windows\System32\termsrv.dll /grant Administrators We can use it to build detection logic: event_type: "processcreatewin" AND proc_file_path: ("takeown.exe" OR "icacls.exe") AND cmdline: "termsrv.dll" We can also hunt for file modification events related to  termsrv.dll : event_type: "filewrite" AND file_path: "termsrv.dll" See you tomorrow!