Detections
- ID: DT119
- Created: 29th April 2025
- Updated: 30th April 2025
- Platform: Windows
- Contributor: The ITM Team
SystemPropertiesRemote.exe Execution
Monitor and alert when the SystemPropertiesRemote.exe binary is executed, particularly by non-administrative users or accounts without prior history of remote access configuration. This executable launches the Remote tab within System Properties, a primary interface for enabling Remote Desktop or Remote Assistance.
Detection Methods
- Enable process creation auditing (Windows Event ID 4688) to capture execution events.
- Deploy EDR or SIEM rules to specifically alert on
SystemPropertiesRemote.exelaunches. - Flag executions by users outside of IT, system administration, or authorized privileged groups.
- Correlate execution events with time-of-day, user role, and subsequent system configuration changes.
Indicators
- Execution of
SystemPropertiesRemote.exeby non-privileged users. - Executions occurring outside standard business hours or approved change windows.
- Execution activity associated with further remote access configuration changes or registry modifications.
Sections
| ID | Name | Description |
|---|---|---|
| PR026 | Remote Desktop (RDP) Access on Windows Systems | The subject initiates configuration changes to enable Remote Desktop Protocol (RDP) or Remote Assistance on a Windows system, typically through the System Properties dialog, registry modifications, or local group policy. This behavior may indicate preparatory actions to grant unauthorized remote access to the endpoint, whether to an external actor, co-conspirator, or secondary account.
CharacteristicsSubject opens the Remote tab within the System Properties dialog (
May configure additional RDP-related settings such as:
Often accompanied by:
In some cases, used to stage access prior to file exfiltration, remote control handoff, or backdoor persistence.
Example ScenarioA subject accesses the Remote tab via |