Terminal Services DLL (T1505.005) is a Windows persistence technique. Terminal Services, called Remote Desktop Services in some Windows Server releases since 2022, delivers a full interactive graphical interface to clients over RDP. MITRE describes how adversaries can abuse its components for persistent access.
How attackers use it
Windows services that run as a generic process such as svchost.exe load their DLL from a path stored in a Registry entry called ServiceDll. For Terminal Services, the default is termsrv.dll, normally in the System32 folder, with the value under the TermService Parameters key in the registry.
MITRE explains that an adversary may modify or replace that DLL to keep access. Changes can run arbitrary payloads while still keeping normal Terminal Services behavior, or they can just unlock abusable features. One example is allowing concurrent RDP sessions, either by patching termsrv.dll or by pointing ServiceDll at a DLL with extra RDP functionality. On non server Windows, this may also let an adversary avoid the prompts that warn or log out a user when a new RDP session starts.
How to detect it
MITRE's analytic describes modification or replacement of termsrv.dll, changes to the ServiceDll registry value, and unexpected module loads by the svchost.exe process running the termsvcs group.
So watch for file changes to termsrv.dll outside Windows updates, registry writes to the TermService Parameters key, and DLLs loaded into that svchost instance that do not match a known good list.
How to reduce the risk
MITRE lists two mitigations:
- Audit: regularly check component software on critical services to verify integrity and spot unexpected changes.
- Restrict Registry Permissions: consider Group Policy to block changes to Terminal Services parameters in the Registry.
Check your own environment
These are read only checks on Windows:
Get-ItemProperty 'HKLM:\System\CurrentControlSet\services\TermService\Parameters' -Name ServiceDll
Get-AuthenticodeSignature C:\Windows\System32\termsrv.dll
The ServiceDll value should point to the expected termsrv.dll, and the file should carry a valid Microsoft signature. If the value points somewhere else, or the signature check fails, investigate.
Quick check
Which registry value controls the DLL that Terminal Services loads?
ServiceDll, under the TermService Parameters key. Its default value is termsrv.dll in the System32 folder.
