Detection rules › Sigma
Potential Remote Desktop Connection to Non-Domain Host
Detects logons using NTLM to hosts that are potentially not part of the domain.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control | T1219.002 Remote Access Tools: Remote Desktop Software |
Event coverage
| Provider | Event | Title |
|---|---|---|
| NTLM | Event ID 8001 | NTLM client blocked audit: Audit outgoing NTLM authentication traffic that would be blocked. |
Rule body yaml
title: Potential Remote Desktop Connection to Non-Domain Host
id: ce5678bb-b9aa-4fb5-be4b-e57f686256ad
status: test
description: Detects logons using NTLM to hosts that are potentially not part of the domain.
references:
- n/a
author: James Pemberton
date: 2020-05-22
modified: 2021-11-27
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
product: windows
service: ntlm
definition: Requires events from Microsoft-Windows-NTLM/Operational
detection:
selection:
EventID: 8001
TargetName|startswith: 'TERMSRV'
condition: selection
falsepositives:
- Host connections to valid domains, exclude these.
- Host connections not using host FQDN.
- Host connections to external legitimate domains.
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
EventID: 8001
TargetName|startswith: 'TERMSRV'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
TargetName | starts_with |
|