Hunt for devices doing first RDP session

Author: Robbe Van den Daele
Source: github.com/HybridBrothers/Hunting-Queries-Detection-Rules

This hunting query can help you find devices doing an RDP connection for the first time in 30 days. While this can be normal behavior, it might be interesting to look at why this device is suddenly doing an RDP connection.

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1021.001` Remote Services: Remote Desktop Protocol

References

https://hybridbrothers.com/detecting-non-privileged-windows-hello-abuse/

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceNetworkEvents` action `ConnectionSuccess`: Connection succeeded

Rule body

let historic_rdp_devices = toscalar(
    DeviceNetworkEvents
    | where Timestamp > ago (30d)
    | where ActionType == "ConnectionSuccess"
    | where RemotePort == 3389
    | summarize make_set(DeviceId)
);
DeviceNetworkEvents
| where Timestamp > ago(1h)
| where ActionType == "ConnectionSuccess"
| where RemotePort == 3389
| where DeviceId !in (historic_rdp_devices)

let historic_rdp_devices = toscalar(
    DeviceNetworkEvents
    | where TimeGenerated > ago (30d)
    | where ActionType == "ConnectionSuccess"
    | where RemotePort == 3389
    | summarize make_set(DeviceId)
);
DeviceNetworkEvents
| where TimeGenerated > ago(1h)
| where ActionType == "ConnectionSuccess"
| where RemotePort == 3389
| where DeviceId !in (historic_rdp_devices)

Stages and Predicates

Let binding: `historic_rdp_devices` used in Stage 5

let historic_rdp_devices = toscalar(
    DeviceNetworkEvents
    | where Timestamp > ago (30d)
    | where ActionType == "ConnectionSuccess"
    | where RemotePort == 3389
    | summarize make_set(DeviceId)
);

Stage 1: `source`

DeviceNetworkEvents

Stage 2: `where`

| where Timestamp > ago(1h)

Stage 3: `where`

| where ActionType == "ConnectionSuccess"

Stage 4: `where`

| where RemotePort == 3389

Stage 5: `where`

| where DeviceId !in (historic_rdp_devices)

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`DeviceId`	eq	`historic_rdp_devices`	`excludes:DeviceId` `field:"DeviceId" value:"historic_rdp_devices"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ActionType`	eq	`ConnectionSuccess`	`field:"ActionType" kind:eq value:"ConnectionSuccess"`
`RemotePort`	eq	`3389`	`field:"DestinationPort" kind:eq value:"3389"`