detection.wiki

Detection rules › Sigma

RDP Connection Allowed Via Netsh.EXE

Status
test
Severity
high
Log source
product windows, category process_creation
Author
Sander Wiebing
Source
github.com/SigmaHQ/sigma

Detects usage of the netsh command to open and allow connections to port 3389 (RDP). As seen used by Sarwent Malware

MITRE ATT&CK coverage

TacticTechniques
Defense ImpairmentT1686.003 Disable or Modify System Firewall: Windows Host Firewall

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: RDP Connection Allowed Via Netsh.EXE
id: 01aeb693-138d-49d2-9403-c4f52d7d3d62
status: test
description: Detects usage of the netsh command to open and allow connections to port 3389 (RDP). As seen used by Sarwent Malware
references:
    - https://labs.sentinelone.com/sarwent-malware-updates-command-detonation/
author: Sander Wiebing
date: 2020-05-23
modified: 2023-12-11
tags:
    - attack.defense-impairment
    - attack.t1686.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\netsh.exe'
        - OriginalFileName: 'netsh.exe'
    selection_cli:
        # Example:
        #   Old: netsh firewall add portopening TCP 3389 "Open Port 3389"
        #   New: netsh advfirewall firewall add rule name= "Open Port 3389" dir=in action=allow protocol=TCP localport=3389
        CommandLine|contains|all:
            - 'firewall '
            - 'add '
            - 'tcp '
            - '3389'
        CommandLine|contains:
            - 'portopening'
            - 'allow'
    condition: all of selection_*
falsepositives:
    - Legitimate administration activity
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_img

selection_img:
    - Image|endswith: '\netsh.exe'
    - OriginalFileName: 'netsh.exe'

Stage 2: selection_cli

selection_cli:
    CommandLine|contains|all:
        - 'firewall '
        - 'add '
        - 'tcp '
        - '3389'
    CommandLine|contains:
        - 'portopening'
        - 'allow'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • 3389
  • add corpus 12 (sigma 12)
  • allow corpus 6 (sigma 4, splunk 2)
  • firewall corpus 2 (sigma 2)
  • portopening corpus 2 (sigma 2)
  • tcp
Imageends_with
  • \netsh.exe corpus 28 (sigma 28)
OriginalFileNameeq
  • netsh.exe corpus 23 (sigma 14, splunk 7, elastic 2)