Detection rules › Splunk
MSTSC Execution (Windows Event Log)
MSTSC creates connections to Remote Desktop Session Host servers or other remote computers, edits an existing Remote Desktop Connection (.rdp) configuration file, and migrates legacy connection files that were created with Client Connection Manager to new .rdp connection files
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement | T1021.001 Remote Services: Remote Desktop Protocol |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '8323.10383'
title: MSTSC Execution
description: 'MSTSC creates connections to Remote Desktop Session Host servers or
other remote computers, edits an existing Remote Desktop Connection (.rdp) configuration
file, and migrates legacy connection files that were created with Client Connection
Manager to new .rdp connection files. - Threat Actor Association: Vice Society -
Software Association: Blackcat/ALPHV, Hive, Lockbit - Atomics T1021.001 Test #1
Atomics T1021.001 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) (TERM(mstsc) OR "mstsc.exe") | table _time, host,
user, signature_id, process, process_*, parent_process_* | bin span=1s | stats values(*)
as * by _time, host | where match(process, "(?i)mstsc") OR match(process_name, "(?i)mstsc") '
techniques:
- lateral-movement:remote services:remote desktop protocol
technique_id:
- T1021.001
data_category:
- Windows event logs
references:
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/mstsc
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) (TERM(mstsc) OR "mstsc.exe")
Stage 2: table
| table _time, host, user, signature_id, process, process_*, parent_process_*
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Stage 5: where
| where match(process, "(?i)mstsc") OR match(process_name, "(?i)mstsc")
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
process | match |
|
process_name | match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | TERM |
| 1 | mstsc |
| 1 | "mstsc.exe" |