T1505.005sub-technique of T1505 Server Software Component
Terminal Services DLL
Windowsnothing on this site yetT1505.005 on attack.mitre.org
Adversaries may abuse components of Terminal Services to enable persistent access to systems. Microsoft Terminal Services, renamed to Remote Desktop Services in some Windows Server OSs as of 2022, enable remote terminal connections to hosts. Terminal Services allows servers to transmit a full, interactive, graphical user interface to clients via RDP.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
how MITRE says to see it
Detection Strategy for T1505.005 – Terminal Services DLL Modification (Windows)
- Adversary modifies or replaces the Terminal Services DLL (`termsrv.dll`) or changes the associated `ServiceDll` Registry value to load an arbitrary or patched DLL that enables persistent and enhanced RDP access.
what reduces it
- M1024 Restrict Registry Permissions. Consider using Group Policy to configure and block modifications to Terminal Services parameters in the Registry.
- M1047 Audit. Regularly check component software on critical services that adversaries may target for persistence to verify the integrity of the systems and identify if unexpected changes have been made.