Restrict Access to Registry Editor

A subject may read the Windows registry using Registry Viewer or PowerShell to help them gain more information about the system, such as keys related to security controls.

The subject initiates configuration or usage of Remote Desktop Protocol (RDP) to enable remote control of an endpoint or server, typically for purposes not sanctioned by the organization. This activity may include enabling RDP settings through system configuration, altering firewall rules, adding users to RDP groups, or initiating browser-based remote access sessions. While RDP is commonly used for legitimate administrative and support purposes, its unauthorized configuration is a well-documented preparatory behavior preceding data exfiltration, sabotage, or persistent unauthorized access.

RDP can be enabled through local system settings, remote management tools, or even web-based services that proxy or tunnel RDP traffic through HTTPS. Subjects may configure RDP access for themselves, for a secondary device, or to facilitate third-party (external) involvement in insider threat activities.

The subject uses applications, binaries, scripts, services, or administrative utilities already trusted or commonly present within the organizational environment to support or conceal an infringement without introducing new software.

Trusted tool misuse may involve operating system utilities, command and scripting environments, archive tools, managed browsers, synchronization clients, productivity applications, remote management components, or administrative consoles. Because these capabilities are routinely used for legitimate purposes, the subject’s activity may avoid software installation alerts, application control restrictions, and indicators associated with unfamiliar executables.

The anti-forensic significance arises where the subject deliberately selects a trusted capability to reduce detection, obscure intent, or make unauthorized activity appear consistent with normal operational use. Investigators should assess the subject’s role, command-line activity, file access, timing, tool combinations, and surrounding investigative indicators. The execution of a trusted tool should not be treated as inherently suspicious.

Example Behaviors

• Using a signed operating-system binary to execute unauthorized code while avoiding controls focused on unknown executables.
• Using PowerShell, Windows Command Shell, Terminal, or a Unix shell to collect, copy, encode, alter, or remove information.
• Using a built-in archive utility to stage sensitive files without installing external compression software.
• Using an approved browser, synchronization client, collaboration platform, or cloud service to transfer information through activity that resembles routine business use.
• Using native screenshot, clipboard, print, preview, export, or file-management functions to collect or alter information without specialist tooling.
• Using a trusted administrative utility or indirect execution pathway to perform unauthorized activity while reducing distinct control violations.
• Using scheduled tasks, launch agents, login items, shortcuts, or existing automation features to repeat activity without introducing new software.

The subject modifies a system, application, or operating environment to preserve unauthorized access, execution, or control beyond the initial activity. The persistence mechanism is intended to remain available following events that would ordinarily interrupt the subject’s access, including system restart, user logoff, application termination, credential changes, or the subject’s departure from the organization.

System persistence may be established through the creation or modification of scheduled tasks, cron jobs, system services, startup items, Registry autorun locations, login scripts, systemd units, Windows Management Instrumentation event subscriptions, SSH authorized keys, web shells, application extensions, or other automatically executed components. The subject may create a new persistence mechanism or alter an existing legitimate component so that unauthorized code, commands, or remote-access functionality is invoked without requiring repeated manual action.

This behavior is preparatory where the subject establishes the mechanism before an intended infringement, allowing access or execution to continue at a later time or under conditions in which the subject’s normal account is unavailable. Persistence may support subsequent unauthorized access, data collection, sabotage, surveillance, or execution by another party.

The subject initiates configuration changes to enable Remote Desktop Protocol (RDP) or Remote Assistance on a Windows system, typically through the System Properties dialog, registry modifications, or local group policy. This behavior may indicate preparatory actions to grant unauthorized remote access to the endpoint, whether to an external actor, co-conspirator, or secondary account.

Characteristics

Subject opens the Remote tab within the System Properties dialog (SystemPropertiesRemote.exe) and enables:

• Remote Assistance
  Remote Desktop

May configure additional RDP-related settings such as:

• Allowing connections from any version of RDP clients (less secure)
  Adding specific users to the Remote Desktop Users group
  Modifying Group Policy to allow RDP access

Often accompanied by:

• Firewall rule changes to allow inbound RDP (TCP 3389)
  Creation of local accounts or service accounts with RDP permissions
  Disabling sleep, lock, or idle timeout settings to keep the system continuously accessible

In some cases, used to stage access prior to file exfiltration, remote control handoff, or backdoor persistence.

Example Scenario

A subject accesses the Remote tab via SystemPropertiesRemote.exe and enables Remote Desktop, selecting the “Allow connections from computers running any version of Remote Desktop” option. They add a personal email-based Microsoft account to the Remote Desktop Users group. No help desk ticket or change request is submitted. Over the following days, successful RDP logins are observed from an IP address outside of corporate VPN boundaries, correlating with a data transfer spike.

The subject modifies the Windows Registry to disable the operating system’s application launch tracking, thereby preventing the creation of key forensic artifacts used to reconstruct user activity. This technique suppresses the generation of records in RunMRU (Run Most Recently Used) and UserAssist, both of which are commonly referenced in forensic timelines to identify command execution and GUI application use.

By setting the registry value:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs = 0

Windows stops logging user application launches, resulting in missing or incomplete histories. This technique is subtle and persistent, particularly effective on systems where registry auditing is not actively enforced.

Example Scenario:
A subject disables application tracking on a corporate workstation using a script that sets Start_TrackProgs = 0 under their HKCU hive. Over several days, they use various portable administrative tools (e.g., credential viewers, compression utilities) without creating entries in RunMRU or UserAssist. When an internal investigation is launched, investigators find an unexpected absence of user activity in these artifacts, delaying attribution and requiring deeper memory analysis to reconstruct events.

A subject abuses their access or conducts unapproved changes to impair the effectiveness of a security agent, such as causing it to crash, killing any associated system processes, installing conflicting software, or preventing connectivity to telemetry domains.

The subject creates or modifies a scheduled task, cron job, system timer, or equivalent mechanism to execute unauthorized commands or code automatically at a future time or recurring interval.

The subject modifies startup folders, Registry autorun locations, XDG autostart entries, login items, shortcuts, or equivalent configurations so that unauthorized code executes during system startup or account logon.

The subject creates or modifies an event subscription, event handler, system hook, or equivalent trigger that executes unauthorized commands or code when specified conditions are met.

The subject creates or modifies an Office template, macro, add-in, Outlook rule, form, home page, or related startup configuration so that unauthorized functionality executes through a Microsoft Office application.