detection.wiki

Detection rules › Kusto

Hunt for devices doing first RDP session

Author
Robbe Van den Daele
Source
github.com/HybridBrothers/Hunting-Queries-Detection-Rules

This hunting query can help you find devices doing an RDP connection for the first time in 30 days. While this can be normal behavior, it might be interesting to look at why this device is suddenly doing an RDP connection.

MITRE ATT&CK coverage

TacticTechniques
Lateral MovementT1021.001 Remote Services: Remote Desktop Protocol

References

Event coverage

ProviderEvent/ActionTypeTitle
SysmonEvent ID 3Network connection
Security-AuditingEvent ID 5156The Windows Filtering Platform has permitted a connection.
Defender-DeviceNetworkEventsConnectionSuccessConnection succeeded

Rule body yaml

let historic_rdp_devices = toscalar(
    DeviceNetworkEvents
    | where Timestamp > ago (30d)
    | where ActionType == "ConnectionSuccess"
    | where RemotePort == 3389
    | summarize make_set(DeviceId)
);
DeviceNetworkEvents
| where Timestamp > ago(1h)
| where ActionType == "ConnectionSuccess"
| where RemotePort == 3389
| where DeviceId !in (historic_rdp_devices)

let historic_rdp_devices = toscalar(
    DeviceNetworkEvents
    | where TimeGenerated > ago (30d)
    | where ActionType == "ConnectionSuccess"
    | where RemotePort == 3389
    | summarize make_set(DeviceId)
);
DeviceNetworkEvents
| where TimeGenerated > ago(1h)
| where ActionType == "ConnectionSuccess"
| where RemotePort == 3389
| where DeviceId !in (historic_rdp_devices)

Stages and Predicates

Let binding: historic_rdp_devices

let historic_rdp_devices = toscalar(
    DeviceNetworkEvents
    | where Timestamp > ago (30d)
    | where ActionType == "ConnectionSuccess"
    | where RemotePort == 3389
    | summarize make_set(DeviceId)
);

Stage 1: source

DeviceNetworkEvents

Stage 2: where

| where Timestamp > ago(1h)

Stage 3: where

| where ActionType == "ConnectionSuccess"

Stage 4: where

| where RemotePort == 3389

Stage 5: where

| where DeviceId !in (historic_rdp_devices)

References historic_rdp_devices (defined above).

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
DeviceIdeqhistoric_rdp_devices

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ActionTypeeq
  • ConnectionSuccess transforms: cased corpus 9 (kusto 9)
RemotePorteq
  • 3389 transforms: cased corpus 11 (kusto 4, elastic 3, sigma 2, splunk 2)