Detect Terminal Services DLL in Google Chronicle

rule t1505_005_terminal_services_dll_persistence {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects Terminal Services DLL persistence: termsrv.dll modification, TermService ServiceDll registry tampering, non-System32 DLL loads for TermService, and RDPWrap registry indicators (MITRE T1505.005)"
    mitre_attack_tactic = "Persistence"
    mitre_attack_technique = "T1505.005"
    severity = "HIGH"
    confidence = "HIGH"
    created = "2026-04-20"

  events:
    (
      // Pattern 1: termsrv.dll file modification by untrusted process
      ($e.metadata.event_type = "FILE_MODIFICATION" or $e.metadata.event_type = "FILE_CREATION") and
      re.regex($e.target.file.full_path, `(?i)termsrv\.dll$`) and
      not re.regex($e.principal.process.file.full_path, `(?i)(TrustedInstaller|wusa|dism|msiexec|setup|svchost)\.exe$`)
    ) or
    (
      // Pattern 2: TermService ServiceDll registry modification
      $e.metadata.event_type = "REGISTRY_MODIFICATION" and
      re.regex($e.target.registry.registry_key, `(?i)TermService.*Parameters`) and
      re.regex($e.target.registry.registry_value_name, `(?i)ServiceDll`)
    ) or
    (
      // Pattern 3: TermService loading termsrv.dll from non-System32 path
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      re.regex($e.principal.process.command_line, `(?i)TermService`) and
      re.regex($e.target.file.full_path, `(?i)termsrv\.dll$`) and
      not re.regex($e.target.file.full_path, `(?i)\\System32\\`)
    ) or
    (
      // Pattern 4: RDPWrap registry indicators
      $e.metadata.event_type = "REGISTRY_MODIFICATION" and
      (
        re.regex($e.target.registry.registry_key, `(?i)rdpwrap`) or
        (
          re.regex($e.target.registry.registry_key, `(?i)TermService`) and
          re.regex($e.target.registry.registry_key, `(?i)(LogFile|SrvcDllInitRegs)`)
        )
      )
    )

  condition:
    $e
}