kevmap

TechniquesT1505.005 › AN0595

AN0595 Analytic 0595

Windows · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Adversary modifies or replaces the Terminal Services DLL (termsrv.dll) or changes the associated ServiceDll Registry value to load an arbitrary or patched DLL that enables persistent and enhanced RDP access. This may include binary replacement, registry tampering, and unexpected module loads by the svchost.exe -k termsvcs process.</p>
Detects
T1505.005 Terminal Services DLL
Part of
DET0212 Detection Strategy for T1505.005 – Terminal Services DLL Modification (Windows)

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
WinEventLog:SecurityEventCode=4657DC0063 Windows Registry Key Modification
WinEventLog:SysmonEventCode=11DC0039 File Creation
WinEventLog:SysmonEventCode=7DC0016 Module Load
WinEventLog:SysmonEventCode=1DC0032 Process Creation

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
TargetDLLPathDefenders may tune for non-standard DLLs loaded by svchost.exe or termsrv.exe processes.
RegistryKeyTargetEnvironment-specific variations in the path to `ServiceDll` registry key (e.g., nested group policies).
TimeWindowCorrelation time window for registry change followed by DLL load or svchost restart.
ParentProcessNameSome environments may spawn registry changes from automation tools or administrative scripts.