Techniques › T1505.005 › AN0595
AN0595 Analytic 0595
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Adversary modifies or replaces the Terminal Services DLL (
termsrv.dll) or changes the associated ServiceDll Registry value to load an arbitrary or patched DLL that enables persistent and enhanced RDP access. This may include binary replacement, registry tampering, and unexpected module loads by the svchost.exe -k termsvcs process.</p>- Detects
- T1505.005 Terminal Services DLL
- Part of
- DET0212 Detection Strategy for T1505.005 – Terminal Services DLL Modification (Windows)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4657 | DC0063 Windows Registry Key Modification |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TargetDLLPath | Defenders may tune for non-standard DLLs loaded by svchost.exe or termsrv.exe processes. |
RegistryKeyTarget | Environment-specific variations in the path to `ServiceDll` registry key (e.g., nested group policies). |
TimeWindow | Correlation time window for registry change followed by DLL load or svchost restart. |
ParentProcessName | Some environments may spawn registry changes from automation tools or administrative scripts. |