T1505.005 — Terminal Services DLL

Tactic: Persistence · Platforms: Windows

Adversaries may abuse components of Terminal Services to enable persistent access to systems. Microsoft Terminal Services, renamed to Remote Desktop Services in some Windows Server OSs as of 2022, enable remote terminal connections to hosts. Terminal Services allows servers to transmit a full,…

Sub-technique of Server Software Component (T1505).

Sigma detection rules (1)

T1505.005 Server Software Component: Terminal Services DLL

title: "T1505.005 Server Software Component: Terminal Services DLL"
id: ff3db7a5-c5cc-4304-bf07-94107ab14b06
description: 'Detection Strategy for T1505.005 - Terminal Services DLL Modification via the TermService ServiceDll registry value. (Data Component: Windows Registry Key Modification; baseline tier: windows-eventid.) Tune using: TargetDLLPath, RegistryKeyTarget, TimeWindow, ParentProcessName.'
references:
  - https://attack.mitre.org/techniques/T1505/005
author: Shahrukh Khan
date: 2026-03-05
license: MIT
tags:
  - attack.persistence
  - attack.t1505.005

logsource:
  category: registry_set
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 13
    TargetObject|endswith: '\Services\TermService\Parameters\ServiceDll'
  filter_legit_path:
    Details|contains: '\Windows\System32\termsrv.dll'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_legit_path and not filter_system_account

falsepositives:
  - Windows servicing/update operations rewriting ServiceDll back to the default path.

level: medium

Related sub-techniques

Explore