Terminal Services ServiceDll registry value modified

Siemphony@siemphonyhighT1505.005unverified

Matches a write to the ServiceDll value under `...\services\TermService\Parameters\`, the registry half of AN0595 and the mechanism the brief describes: TermService is a generic svchost-hosted service, and svchost resolves which DLL to load for it from this single value at start. ServiceDll is a value name inside the Parameters subkey, not a subkey itself, so the match anchors on the full tail `\TermService\Parameters\ServiceDll` rather than stopping at Parameters — stopping short would match every service that keeps a Parameters key, which is most of them. Unlike the AppInit_DLLs value used in the sibling T1546.010 rule, this key lives under HKLM\SYSTEM rather than HKLM\SOFTWARE, so there is no Wow6432Node twin to also cover. The brief maps this from Security EventID 4657 onto Sigma's registry_set category, which is Sysmon-shaped (TargetObject); that is the vocabulary this rule is written in, and a deployment that only has 4657 (which itself needs Audit Registry auditing plus a SACL on this key, off by default) would need ObjectName/ ObjectValueName mapped onto TargetObject before this rule can run against it. AN0595's DLL-replacement, module-load and svchost-restart legs need a correlation across separate Sysmon channels that Sigma cannot express, so only the registry write is attempted. Sysmon registry monitoring is an allowlist of paths; confirm this key is included before reading silence as a clean result. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0212, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceRegistryEvents| where RegistryKey endswith "\\services\\TermService\\Parameters\\ServiceDll"

Splunk · SPL

Run this as a search.

index=* TargetObject="*\\services\\TermService\\Parameters\\ServiceDll"

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE TO_LOWER(registry.path) LIKE "*\\\\services\\\\termservice\\\\parameters\\\\servicedll"

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,registry_set,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetObject" type="pcre2">(?i)\\services\\TermService\\Parameters\\ServiceDll$</field>    <description>Terminal Services ServiceDll registry value modified</description>    <mitre>      <id>T1505.005</id>    </mitre>  </rule></group>

At a glance

Logsource: registry_set / windows
Level: high
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 70075706-801a-4898-ac7e-d2ee2d965e48

ATT&CKT1505.005

T1505.005Terminal Services DLL

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

A write to the ServiceDll value under ...\services\TermService\Parameters\ — the registry half of AN0595. Terminal Services runs as a generic svchost.exe-hosted service, and svchost resolves which DLL to load for it from this single registry value at start. Change the value and you change what code runs every time the service starts, which is the persistence mechanism the technique describes. AN0595 also covers replacing termsrv.dll on disk, an unexpected module load into svchost.exe -k termsvcs, and a subsequent service restart — none of that is authored here; Sigma cannot join a registry write to a later module-load event, so only the registry leg is attempted.

02 · Telemetry you need

registry_set/Sysmon EventID 13, with this key included in Sysmon's registry monitoring allowlist — confirm it, since silence from an excluded path looks identical to silence from a clean environment. The brief maps this from Security EventID 4657 onto the same Sigma category, but 4657 is a different shape: it splits the key and value into separate ObjectName/ ObjectValueName fields where registry_set carries both in one TargetObject. A 4657-only deployment needs that field mapped before this rule can run against it, and 4657 itself needs Audit Registry auditing plus a SACL on this specific key — neither on by default.

03 · How the logic works

The anchor has to reach past Parameters onto ServiceDll, the value name itself. On a registry_set/value-set event, TargetObject always ends in the value name, never the subkey — so a selector stopping at \Parameters isn't too broad, it's dead: it would never fire against this logsource at all. That correction matters because the shipped selector is already anchored correctly; it's the reasoning for why that a reviewer had to fix. Because this key lives under HKLM\SYSTEM, not HKLM\SOFTWARE like the AppInit_DLLs key in the sibling T1546.010 rule, there's no Wow6432Node twin to also cover.

04 · Common false positives

OS servicing repairing the value back to default — an in-place upgrade,
RDS role install, removal or reconfiguration via Server Manager or DISM on
Configuration-management tooling (SCCM baselines, GPO drift remediation)
Missed by the rule's own list, per the reviewer: a helpdesk technician

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0212 and never executed against logs. Two real blind spots the reviewer found: direct termsrv.dll file replacement never touches this registry value, and editing the SYSTEM hive offline (booted media, reg load, a shadow-copied hive) writes ServiceDll with no live ETW provider running to generate either a Sysmon 13 or a Security 4657.
tier_2: means confirming the patch-window burst by parent process before trusting high, and adding process-lineage suppression.
tier_3: means the module-load correlation and closing the offline-hive gap with a separate detection.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

level: high assumes the servicing false positive stays rare. The reviewer disputed that: a single cumulative-update rollout fires this same write on every managed endpoint in the same patch window, which can be the highest-volume match by a wide margin fleet-wide — exactly the calibration failure the authoring contract warns against. MITRE's ParentProcessName knob is the fix: gate out TrustedInstaller.exe, dism.exe, msiexec.exe and the management agent's process, and treat anything else writing this value as high-priority. The TargetDLLPath and TimeWindow knobs need the Sysmon 7 module-load leg this rule doesn't carry.

Declared by the author

Operating-system servicing repairing this value back to its default: an in-place upgrade, a DISM /RestoreHealth or SFC repair pass, or a cumulative update reinstalling the Terminal Services component all rewrite ServiceDll, but only during a patch or repair window, not during ordinary operation.
Remote Desktop Services role installation, removal or reconfiguration through Server Manager or DISM on a session-host or RD Connection Broker deployment, which legitimately touches this exact value each time the role configuration changes.
Configuration-management or hardening tooling (SCCM baselines, GPO drift remediation) that periodically rewrites service parameters to a known-good value as part of a compliance pass; the writing process in these cases is the management agent, not svchost.exe or termsrv.exe.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1505.005, evaluated against their registry_set events.

Share this rule

/u/siemphony/70075706-801a-4898-ac7e-d2ee2d965e48

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Terminal Services ServiceDll registry value modified

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it