ITM is an open framework - Submit your contributions now.

Detections

ConsoleHost_history.txt Created Timestamp Discrepancy

ConsoleHost_history.txt File Missing

Windows File Deleted, Event Logs

Windows System Logging was Cleared

Print Spooler Service

Installed Printers via Registry

Printed Documents via Event Logs

Tamper Seal

Cyber Deception, File Canary

Cyber Deception, Honeypot

Cyber Deception, Honey User

Windows Operating System Installed Date

NTFS Timestamp Discrepancy

Utilize Cold Storage for Logs

Windows Local Account Deleted

Windows System Shutdown, Event Logs

Firefox Browser History

Edge Browser History

Chrome Browser History

Shellbags, USB Removable Storage

USBSTOR Registry Key

USB Registry Key

MountedDevices Registry Key

Windows Event Log, DriverFrameworks-UserMode

Windows Setupapi.dev.log

Windows LNK Files

Windows Prefetch

File Metadata

File EXIF Data

auditd Timestamp Modification Rule

Windows Thumbcache

Closed-Circuit Television

Terminal Service Client Registry Key

RDP Bitmap Cache

Windows Jump Lists

auditd File Access

Windows Recycle Bin

Web Proxy Logs

Microsoft Exchange Message Trace

Email Gateway

Network Intrusion Detection Systems

Sysmon Process Create Event

Linux dpkg Log

Agent Capable of User Activity Monitoring

Agent Capable of Endpoint Detection and Response

Agent Capable of User Behaviour Analytics

Data Loss Prevention Solution

Social Media Monitoring

Impossible Travel

DNS Logging

Audit Logging

Missing .bash_history File

.bash_history Timestamp Discrepency

PowerShell Logging

User Account Deleted, Windows Event Log

Chrome Browser Cookies

Chrome Browser Login Data

Chrome Browser Bookmarks

Chrome Browser Extensions

Notepad.exe TabState

Microsoft 365 Admin Center Sign-in Activity

Microsoft Entra ID Sign-in Logs

AWS CloudTrail, Resource Deletion

GCP Cloud Audit Logs, Resource Deletion

Azure Activity Log, Resource Deletion

Financial Auditing

Windows Event Log, Logon and Logoff

Security Software Anti-Tampering Alerts

Windows Event Log, Local Firewall Changes

Map Network Drive MRU

TypedPaths

Network Registry Key

Shellbags, Network Drives

USB MountPoints2

Bash History

AzureAD PowerShell Log

Clipboard Payloads via ActivitiesCache.db

MFT Entry Number Sequence Irregularities

MFT Unusual Timestamp Patterns

MFT and Shimcache Executable Timestamp Comparison

Microsoft Purview Audit Search

Windows Event Log, Software Uninstallation

DNS Monitoring

Deep Packet Inspection

NetFlow Analysis

Windows Event Log, Audit Removable Storage

Virtual Private Network (VPN) Logs

User Behavior Analytics (UBA)

User and Entity Behavior Analytics (UEBA)

Photographic Identification Comparison

Leaver Watchlist

vssadmin Shadow Copy Deletion

Microsoft Entra ID Privileged Identity Management Resource Audit

Microsoft Teams Admin Center Meeting and Call History

macOS File System Events (FSEvents) Store Database

Windows Event Log, System Time Modification

MIP Label Activity Monitoring

Cyber Deception, Honey SPN

Asset Discovery Audit

Tracking Patterns of Policy Violations

Baseline System Performance Profiling

AWS Unauthorized System or Service Modification

GCP Unauthorized System or Service Modification

Azure Unauthorized System or Service Modification

OCI Unauthorized System or Service Modification

SystemPropertiesRemote.exe Execution

Modification of RDP Registry Keys

RDP Group Membership Changes

ID: DT121
Created: 29th April 2025
Updated: 29th April 2025
Platform: Windows
Contributor: The ITM Team

RDP Group Membership Changes

Monitor and alert when users are added to the local Remote Desktop Users group on Windows systems. Unauthorized additions to this group provide remote logon privileges and may indicate preparatory insider activity.

Detection Methods

Audit group membership changes using Windows Security Event ID 4732.
Track additions to the Remote Desktop Users group (SID: S-1-5-32-555).
Correlate membership changes with user identity, prior privilege levels, and change management records.

Indicators

Unauthorized or unexpected users added to the Remote Desktop Users group.
Membership changes performed outside approved IT operations or helpdesk interventions.
Additions correlated with accounts flagged for prior policy violations or behavioral risk indicators.

Sections

ID	Name	Description
PR026	Remote Desktop (RDP) Access on Windows Systems	The subject initiates configuration changes to enable Remote Desktop Protocol (RDP) or Remote Assistance on a Windows system, typically through the System Properties dialog, registry modifications, or local group policy. This behavior may indicate preparatory actions to grant unauthorized remote access to the endpoint, whether to an external actor, co-conspirator, or secondary account. Characteristics Subject opens the Remote tab within the System Properties dialog (`SystemPropertiesRemote.exe`) and enables: Remote Assistance Remote Desktop May configure additional RDP-related settings such as: Allowing connections from any version of RDP clients (less secure) Adding specific users to the `Remote Desktop Users group` Modifying Group Policy to allow RDP access Often accompanied by: Firewall rule changes to allow inbound RDP (`TCP 3389`) Creation of local accounts or service accounts with RDP permissions Disabling sleep, lock, or idle timeout settings to keep the system continuously accessible In some cases, used to stage access prior to file exfiltration, remote control handoff, or backdoor persistence. Example Scenario A subject accesses the Remote tab via `SystemPropertiesRemote.exe` and enables Remote Desktop, selecting the “Allow connections from computers running any version of Remote Desktop” option. They add a personal email-based Microsoft account to the Remote Desktop Users group. No help desk ticket or change request is submitted. Over the following days, successful RDP logins are observed from an IP address outside of corporate VPN boundaries, correlating with a data transfer spike.