Detection rules › By catalog entry

Microsoft-Windows-TerminalServices-RemoteConnectionManager

Catalog entry	Rules
Event ID 1149	4
Event ID 20503	1
Event ID 20504	1
Event ID 20508	1

Event ID 1149

4 detection rules reference this catalog entry. View catalog entry.

Sigma (3)

RDP reconnaissance with valid credentials performed on multiple hosts severity high T1021,T1021.001,T1078
RDP tunneling detected severity high T1021,T1021.001,T1572
RDP tunneling via ngrok detected severity high T1021,T1021.001,T1572

Splunk (1)

Windows RDP Connection Successful T1563,T1563.002

Event ID 20503

1 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

RDP shadow session started (native) severity medium T1021,T1021.001,T1113,T1125

Event ID 20504

1 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

RDP shadow session started (native) severity medium T1021,T1021.001,T1113,T1125

Event ID 20508

1 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

RDP shadow session started (native) severity medium T1021,T1021.001,T1113,T1125

Back to all Microsoft-Windows-TerminalServices-RemoteConnectionManager catalog entries