tfMITRE ATT&CK sub-technique

Terminal Services DLL T1505.005

sub-technique of T1505 Server Software Component

Tactic: Persistence
Platform: Windows
Version: 1.0
Created: 28 March 2022
Last modified: 24 October 2025

Adversaries may abuse components of Terminal Services to enable persistent access to systems. Microsoft Terminal Services, renamed to Remote Desktop Services in some Windows Server OSs as of 2022, enable remote terminal connections to hosts. Terminal Services allows servers to transmit a full, interactive, graphical user interface to clients via RDP.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Offense vs defense T1505.005

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 0

first rule: 2022 Q4

Terminal Services DLL detection strategy DET0212

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for T1505.005 – Terminal Services DLL Modification (Windows)

Enterprise

1 platform

AN0595 · Windows

Adversary modifies or replaces the Terminal Services DLL (termsrv.dll) or changes the associated ServiceDll Registry value to load an arbitrary or patched DLL that enables persistent and enhanced RDP access. This may include binary replacement, registry tampering, and unexpected module loads by the svchost.exe -k termsvcs process.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Windows Registry Key ModificationDC0063	WinEventLog:Security	EventCode=4657

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TargetDLLPath	Defenders may tune for non-standard DLLs loaded by svchost.exe or termsrv.exe processes.
RegistryKeyTarget	Environment-specific variations in the path to `ServiceDll` registry key (e.g., nested group policies).
TimeWindow	Correlation time window for registry change followed by DLL load or svchost restart.
ParentProcessName	Some environments may spawn registry changes from automation tools or administrative scripts.

Tests2ExecutorsPowerShell 2Need elevation2 of 2Have prerequisites0Have cleanup2Platformswindows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	Simulate Patching termsrv.dll	windows	PowerShell	Required	—	Yes
Simulates patching of termsrv.dll by making a benign change to the file and replacing it with the original afterwards. Before we can make the modifications we need to take ownership of the file and grant ourselves the necessary permissions. Attack command $termsrvDll = "C:\Windows\System32\termsrv.dll" $ACL = Get-Acl $termsrvDll $permission = "Administrators","FullControl","Allow" $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission $ACL.SetAccessRule($accessRule) Set-Acl -Path $termsrvDll -AclObject $ACL Copy-Item -Path "C:\Windows\System32\termsrv.dll" -Destination "C:\Windows\System32\termsrv_backup.dll" -ErrorAction Ignore Add-Content -Path "C:\Windows\System32\termsrv.dll" -Value "`n" -NoNewline -ErrorAction Ignore Move-Item -Path "C:\Windows\System32\termsrv_backup.dll" -Destination "C:\Windows\System32\termsrv.dll" -Force -ErrorAction Ignore Cleanup command Move-Item -Path "C:\Windows\System32\termsrv_backup.dll" -Destination "C:\Windows\System32\termsrv.dll" -Force -ErrorAction Ignore GUID4c1f452a-ef81-49d0-a79d-6c70cba2cb09
02	Modify Terminal Services DLL Path	windows	PowerShell	Required	—	Yes
This atomic test simulates the modification of the ServiceDll value in HKLM\System\CurrentControlSet\services\TermService\Parameters. This technique may be leveraged by adversaries to establish persistence by loading a patched version of the DLL containing malicious code. Attack command $termsrvDll = "C:\Windows\System32\termsrv.dll" $ACL = Get-Acl $termsrvDll $permission = "Administrators","FullControl","Allow" $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission $ACL.SetAccessRule($accessRule) Set-Acl -Path $termsrvDll -AclObject $ACL Copy-Item -Path $termsrvDll -Destination "$HOME\AtomicTest.dll" $newServiceDll = "$HOME\AtomicTest.dll" $registryPath = "HKLM:\System\CurrentControlSet\services\TermService\Parameters" # Check if the registry key exists if (Test-Path -Path $registryPath) { # Modify the ServiceDll value in the registry Set-ItemProperty -Path $registryPath -Name "ServiceDll" -Value $newServiceDll Write-Host "ServiceDll value in the registry has been updated to: $newServiceDll" } else { Write-Host "Registry key not found. Make sure the 'TermService\Parameters' key exists." } Cleanup command Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\services\TermService\Parameters" -Name "ServiceDll" -Value "C:\Windows\System32\termsrv.dll" GUIDba189b35-1dad-4485-8c03-6c351984f1fe

Tests from Atomic Red Team (MIT licence) · technique definition

Terminal Services DLL detections T1505.005

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs