RDP Logon-Screen Backdoor Detection

Guard automatically detects accessibility-tool backdoors planted at the Windows RDP logon screen — no credentials required. This capability closes a gap that credential-testing tools cannot address: a sticky-keys or utilman replacement persists after password rotation and is reachable by any unauthenticated user with network access to the RDP port.

How it works

The logon-backdoor capability runs pre-authentication against every in-scope RDP port discovered by Guard. It probes the logon screen for known accessibility-tool replacement patterns — specifically, substitutions of sethc.exe (Sticky Keys) or Utilman with a SYSTEM-level shell — and emits findings without requiring valid credentials or interactive access.

Detection runs unattended on Guard's standard scan cadence. There is no manual gate or separate configuration step required.

Findings

When a backdoor is detected, Guard files a finding with the following attributes:

Each finding includes a full description, impact statement, and remediation guidance inline. No additional research is needed to act on the result.

Why credential rotation does not fix this

A sticky-keys or utilman backdoor is not a credential problem. An attacker who plants this persistence mechanism retains SYSTEM-level shell access at the logon screen regardless of subsequent password changes. The only way to detect it is through a dedicated pre-authentication probe — which is exactly what the logon-backdoor capability performs.

Scope and prerequisites

• The capability runs against all RDP ports (default TCP 3389) that fall within your defined attack surface.
• No credentials, agents, or additional configuration are required.
• Detection is pre-authentication only, matching the access path an attacker would use.

Remediation

When a finding is raised:

1. Verify the substitution — confirm that sethc.exe, utilman.exe, or related accessibility binaries have been replaced or modified on the affected host.
2. Restore legitimate binaries — replace any modified executables with known-good originals from installation media or a trusted source.
3. Investigate the root cause — the backdoor indicates a prior compromise. Conduct a full incident review to determine initial access, lateral movement, and any additional persistence mechanisms.
4. Audit other RDP hosts — if one host is affected, treat the rest of your RDP-exposed estate as potentially compromised until verified.