ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™

  • ID: DT121
  • Created: 29th April 2025
  • Updated: 30th April 2025
  • Platform: Windows
  • Contributor: The ITM Team

RDP Group Membership Changes

Monitor and alert when users are added to the local Remote Desktop Users group on Windows systems. Unauthorized additions to this group provide remote logon privileges and may indicate preparatory insider activity.

 

Detection Methods

  • Audit group membership changes using Windows Security Event ID 4732.
  • Track additions to the Remote Desktop Users group (SID: S-1-5-32-555).
  • Correlate membership changes with user identity, prior privilege levels, and change management records.

 

Indicators

  • Unauthorized or unexpected users added to the Remote Desktop Users group.
  • Membership changes performed outside approved IT operations or helpdesk interventions.
  • Additions correlated with accounts flagged for prior policy violations or behavioral risk indicators.

Sections

ID Name Description
PR026Remote Desktop (RDP) Access on Windows Systems

The subject initiates configuration changes to enable Remote Desktop Protocol (RDP) or Remote Assistance on a Windows system, typically through the System Properties dialog, registry modifications, or local group policy. This behavior may indicate preparatory actions to grant unauthorized remote access to the endpoint, whether to an external actor, co-conspirator, or secondary account.

 

Characteristics

Subject opens the Remote tab within the System Properties dialog (SystemPropertiesRemote.exe) and enables:

  • Remote Assistance
  • Remote Desktop

 

May configure additional RDP-related settings such as:

  • Allowing connections from any version of RDP clients (less secure)
  • Adding specific users to the Remote Desktop Users group
  • Modifying Group Policy to allow RDP access

 

Often accompanied by:

  • Firewall rule changes to allow inbound RDP (TCP 3389)
  • Creation of local accounts or service accounts with RDP permissions
  • Disabling sleep, lock, or idle timeout settings to keep the system continuously accessible

 

In some cases, used to stage access prior to file exfiltration, remote control handoff, or backdoor persistence.

 

Example Scenario

A subject accesses the Remote tab via SystemPropertiesRemote.exe and enables Remote Desktop, selecting the “Allow connections from computers running any version of Remote Desktop” option. They add a personal email-based Microsoft account to the Remote Desktop Users group. No help desk ticket or change request is submitted. Over the following days, successful RDP logins are observed from an IP address outside of corporate VPN boundaries, correlating with a data transfer spike.