MSTSC Execution (Windows Event Log)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

MSTSC creates connections to Remote Desktop Session Host servers or other remote computers, edits an existing Remote Desktop Connection (.rdp) configuration file, and migrates legacy connection files that were created with Client Connection Manager to new .rdp connection files

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1021.001` Remote Services: Remote Desktop Protocol

References

https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/mstsc

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

id: '8323.10383'
title: MSTSC Execution
description: 'MSTSC creates connections to Remote Desktop Session Host servers or
  other remote computers, edits an existing Remote Desktop Connection (.rdp) configuration
  file, and migrates legacy connection files that were created with Client Connection
  Manager to new .rdp connection files. - Threat Actor Association: Vice Society -
  Software Association: Blackcat/ALPHV, Hive, Lockbit - Atomics T1021.001 Test #1
  Atomics T1021.001 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(mstsc) OR "mstsc.exe") | table _time, host,
  user, signature_id, process, process_*, parent_process_* | bin span=1s | stats values(*)
  as * by _time, host | where match(process, "(?i)mstsc") OR match(process_name, "(?i)mstsc") '
techniques:
- lateral-movement:remote services:remote desktop protocol
technique_id:
- T1021.001
data_category:
- Windows event logs
references:
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/mstsc

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) (TERM(mstsc) OR "mstsc.exe")

Stage 2: `table`

| table _time, host, user, signature_id, process, process_*, parent_process_*

Stage 3: `bucket`

| bin span=1s

Stage 4: `stats`

| stats values(*) as * by _time, host

Stage 5: `where`

| where match(process, "(?i)mstsc") OR match(process_name, "(?i)mstsc")

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4688` corpus 317 (splunk 283, kusto 33, elastic 1)	`field:"EventID" kind:eq value:"4688"`
`process`	regex_match	`"(?i)mstsc"`	`field:"CommandLine" kind:regex_match`
`process_name`	regex_match	`"(?i)mstsc"`	`field:"process_name" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>4688<"`
1	`mstsc`
1	`"mstsc.exe"`