Detection rules › Sigma
Denied RDP login with valid credentials
Detects scenarios where an attacker tries to move laterally using RDP and access attempt is blocked due to restricted logon policies.
Known false positives
- Miss configured adminitrative rights or VDI software (CITRIX, AppV, ThinApp, ...)
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4825: A user was denied the access to Remote Desktop. |
Rule body
title: Denied RDP login with valid credentials
description: Detects scenarios where an attacker tries to move laterally using RDP and access attempt is blocked due to restricted logon policies.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.001-Remote%20Desktop%20Protocol
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4825
tags:
- attack.lateral_movement
- attack.t1021.001 # Remote desktop
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4825
condition: selection
falsepositives:
- Miss configured adminitrative rights or VDI software (CITRIX, AppV, ThinApp, ...)
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
EventID: 4825