Remote Desktop listener moved to a non-standard port

Siemphony@siemphonymediumT1571unverified

Matches the configuration half of this technique — an adversary changing the port a standard protocol listens on — using the process-creation log source AN0633 lists alongside its connection source. The command line must carry both `RDP-Tcp` and `PortNumber`, the WinStations key and value under HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server that hold the Remote Desktop listening port, which is the change MITRE cites from the Conti playbook. Gating on the two strings rather than on an image catches the edit whichever tool performs it — reg.exe, PowerShell Set-ItemProperty, wmic — and needs no registry auditing enabled. The other half of AN0633 is not attempted, and the reason matters. Detecting "a protocol on a port not normally associated with it" needs two things Sigma cannot supply: protocol identification, which Security 5156/5157 does not do — the Filtering Platform records a five-tuple and an image, so HTTPS smuggled over 587 and ordinary mail submission on 587 are the same event there — and a per-organisation port baseline, which is exactly what MITRE's PortThresholds knob describes and what lib/sigma has no aggregation or baselining to express. A hardcoded list of "suspicious" ports would fire on the legitimate service that owns each one, so none is written. Limits of what is here: a port change made through the registry API by a compiled implant, or applied by importing a .reg file (the command line then names the file, not the key), produces no matching command line; a read of the same value matches identically to a write, since a process-creation event carries no notion of either; and only RDP is covered, not SSH, WinRM or a service moved by editing its own config file. Written in the Sysmon EventID 1 vocabulary (Image, CommandLine); where this category is fed by Security EventID 4688 instead, that channel needs *Audit Process Creation* plus the separate *Include command line in process creation events* policy before CommandLine is populated at all. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0227, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "RDP-Tcp" and ProcessCommandLine contains "PortNumber")

Splunk · SPL

Run this as a search.

index=* (CommandLine="*RDP-Tcp*" AND CommandLine="*PortNumber*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*rdp-tcp*" AND TO_LOWER(process.command_line) LIKE "*portnumber*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(?=.*(?:RDP-Tcp))(?=.*(?:PortNumber)).*</field>    <description>Remote Desktop listener moved to a non-standard port</description>    <mitre>      <id>T1571</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: reverse_shell
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: a8511692-961e-45bf-837c-640fa3b2a36e

ATT&CKT1571

T1571Non-Standard Port

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonreverse shell

reverse shellAI draft — unreviewed

01 · What this rule detects

"Remote Desktop listener moved to a non-standard port" covers the configuration half of T1571 under DET0227. It looks for a command line touching the RDP-Tcp\PortNumber value under HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations — the value that decides which port Remote Desktop listens on, and the change MITRE cites from the Conti playbook. Be precise about the claim: the rule establishes that the value was touched, not that the new port is non-standard, and not that anything was written at all.

02 · Telemetry you need

Sysmon EventID 1, mapped to the process_creation / windows logsource taken from AN0633's second log source. Only CommandLine is read, so command-line capture must be on. In Sysmon vocabulary that is the default; where the same Sigma category is fed by Security 4688, that channel needs Audit Process Creation plus the separate Include command line in process creation events policy, or CommandLine is empty and the rule silently returns nothing. No registry auditing is required — which is the point of detecting the edit through the command line rather than through Sysmon EID 13.

03 · How the logic works

A single selection with one field and an all modifier: CommandLine|contains|all on RDP-Tcp and PortNumber. Both substrings must appear in the same command line, which is what keeps it tight — either alone is common enough to be useless, and together they only co-occur on a reference to this specific key and value. There is no Image gate, so the edit is caught whichever tool performs it: reg.exe, PowerShell Set-ItemProperty, or wmic. The rule does not inspect the value data, because a process-creation event does not carry it. Setting the port back to 3389 matches exactly like moving it to 8088. Neither does the event distinguish a read from a write, so reg query matches like reg add. Three routes escape entirely: importing a .reg file (the command line names the file, not the key), a compiled implant calling RegSetValueEx, and PowerShell building the key path from a variable. Only RDP is covered — not SSH, WinRM, or any service moved by editing its own config file.

04 · Common false positives

Compliance and inventory jobs that read the value back to report which port RDP is listening on match both substrings without changing anything, and where such a job runs estate-wide it is the top talker by a wide margin. Hardening baselines and MSP onboarding scripts that deliberately move RDP off 3389 fire once on every newly built host, using the same command with the same key and value as the abuse case — separated only by who scheduled it. Remote-support product installers reconfigure the listener during setup, and administrators resolving a port conflict do the same by hand. level: medium is defensible only where no scheduled read of this value exists; find one and drop to low.

05 · Detection maturity

tier_1: Lowest tier. This has never run against a log line, and AN0633's connection half remains uncovered for this technique, so T1571 should not be read as done. Execute it over historical data, confirm what your estate legitimately does to this value, then calibrate.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's PortThresholds knob asks you to define non-standard relative to your own baseline, and ProcessAllowList names processes normally permitted on unusual ports. Neither is expressible in this rule, which is why AN0633's actual observable — correlating process creation with the outbound connection that follows — is not attempted here. Security 5156/5157 record a five-tuple and an image but do not identify protocol, so a tunnel over 587 and ordinary mail submission are the same event; the baselining needs aggregation this Sigma has none of. Tune what you have instead: exclude your build and compliance tooling by ParentImage, and pair a hit with the registry-set or listening-port evidence that reveals the value actually written.

Declared by the author

Inventory, compliance and monitoring scripts that read the value back to report which port Remote Desktop is listening on — reg query or Get-ItemProperty against the same key. They match both substrings without changing anything, and where such a job runs estate-wide it is the top talker by a wide margin, which is what holds this rule at medium.
Hardening baselines and build automation that deliberately move Remote Desktop off 3389, including MSP onboarding scripts and imaging task sequences. These are the same command with the same key and value as the abuse case, separated only by who scheduled them, and they fire once on every newly built host.
Installers and upgrades for remote-support and remote-access products that reconfigure or restore the Remote Desktop listener port as part of setup.
An administrator resolving a port conflict on a host running another service on 3389, or reverting a previous change during a support call.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1571, evaluated against their process_creation events.

Share this rule

/u/siemphony/a8511692-961e-45bf-837c-640fa3b2a36e

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Remote Desktop listener moved to a non-standard port

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it