detection.wiki

Detection rules › Sigma

Denied RDP login with valid credentials

Status
experimental
Severity
medium
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker tries to move laterally using RDP and access attempt is blocked due to restricted logon policies.

MITRE ATT&CK coverage

TacticTechniques
Lateral MovementT1021.001 Remote Services: Remote Desktop Protocol

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 4825A user was denied the access to Remote Desktop.

Rule body yaml

title: Denied RDP login with valid credentials
description: Detects scenarios where an attacker tries to move laterally using RDP and access attempt is blocked due to restricted logon policies.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.001-Remote%20Desktop%20Protocol
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4825
tags:
- attack.lateral_movement
- attack.t1021.001 # Remote desktop
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4825
  condition: selection
falsepositives:
- Miss configured adminitrative rights or VDI software (CITRIX, AppV, ThinApp, ...)
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 4825