id: rdp-nla-disabled

info:
  name: Network Level Authentication for RDP Disabled
  author: princechaddha
  severity: high
  description: Checks if Network Level Authentication (NLA) for Remote Desktop Protocol is disabled, increasing the risk of unauthorized access.
  impact: |
    Disabling NLA for RDP exposes the system to potential unauthorized remote access and brute force attacks.
  remediation: |
    Enable Network Level Authentication (NLA) to secure remote desktop connections.
  tags: windows,rdp,nla,authentication,code,windows-audit

self-contained: true

code:
  - pre-condition: |
      IsWindows();
    engine:
      - powershell
      - powershell.exe
    args:
      - -ExecutionPolicy
      - Bypass
    pattern: "*.ps1"
    source: |
      Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'UserAuthentication'

    matchers:
      - type: word
        words:
          - "UserAuthentication : 0"
# digest: 4a0a00473045022100c672fc3e3cf375ae4e1433961ce0415a469e3d0a75794d319c67c7c7ada0325d02207266cbbe50f25750e2a6e188396638919544e85e612d5a74217be7c45928ebcf:922c64590222798bb761d5b6d8e72950