Detection rules › Sigma
RDP reconnaissance with valid credentials performed on multiple hosts
Detects scenarios where an attacker attempts to brutforce RDP services with compromised credentials via tools like Hydra. Note that this event will be reported only with valid user and password credentials, and it may be reported only when RDP session is fully opened (so not during reconnaisance phase) if NLA is disabled. For further correlation, ID 4624/4625 (logon type 3, 7 or 10) should be used.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1078 Valid Accounts |
| Lateral Movement | T1021.001 Remote Services: Remote Desktop Protocol |
Rule body yaml
title: RDP reconnaissance with valid credentials performed on multiple hosts
name: rdp_reconnaissance_valid_cred
description: Detects scenarios where an attacker attempts to brutforce RDP services with compromised credentials via tools like Hydra. Note that this event will be reported only with valid user and password credentials, and it may be reported only when RDP session is fully opened (so not during reconnaisance phase) if NLA is disabled. For further correlation, ID 4624/4625 (logon type 3, 7 or 10) should be used.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0001-Initial%20access/T1078-Valid%20accounts
- https://github.com/mehranexpert/Crazy-RDP
- https://github.com/3gstudent/SharpRDPCheck
- https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/
- https://purerds.org/remote-desktop-security/auditing-remote-desktop-services-logon-failures-1/
- http://woshub.com/rdp-connection-logs-forensics-windows/
- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/mstsc.htm
- https://github.com/AndrewRathbun/DFIRMindMaps/tree/main/OSArtifacts/Windows/RDP_Authentication_Artifacts
- https://github.com/TonyPhipps/SIEM/blob/master/Notable-Event-IDs.md#microsoft-windows-remotedesktopservices-rdpcoretsoperational
- https://dfironthemountain.wordpress.com/2019/02/15/rdp-event-log-dfir/
- https://nullsec.us/windows-event-id-1029-hashes/
- https://www.13cubed.com/downloads/rdp_flowchart.pdf
- https://nullsec.us/windows-rdp-related-event-logs-the-client-side-of-the-story/
tags:
- attack.initial_access
- attack.t1078 # valid account
- attack.lateral_movement
- attack.t1021.001 # remote services: RDP
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 1149 # 'User authentication succeeded': DOES NOT indicate a successful user authentication !!!
Channel: Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
filter:
IpAddress: # In ID 1149, IP address is provided in "EventXML.Param3"
- "%vulnerability_scanners%"
- "%admin_jump_hosts%"
- "127.0.0.1"
- "::1"
condition: selection and not filter
falsepositives:
- VAS scanners, administrator jump host
level: high
---
title: RDP reconnaissance with valid credentials performed on multiple hosts Count
status: experimental
correlation:
type: value_count
rules:
- rdp_reconnaissance_valid_cred # Referenced here
group-by:
- IpAddress
timespan: 5m
condition:
gte: 20
field: Computer
level: high
Stages and Predicates
Stage 0: condition
selection and not filterStage 1: selection
selection:
EventID: 1149
Channel: Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
Stage 2: not filter
filter:
IpAddress:
- "%vulnerability_scanners%"
- "%admin_jump_hosts%"
- "127.0.0.1"
- "::1"
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
IpAddress | eq | %admin_jump_hosts% |
IpAddress | eq | %vulnerability_scanners% |
IpAddress | eq | 127.0.0.1 |
IpAddress | eq | ::1 |