Detection rules › Splunk

RDP Connection (Windows Event Log)

Group by
_time, host
Source
github.com/anvilogic-forge/armory

This use case looks for when an RDP network connection has been established

MITRE ATT&CK coverage

References

Telemetry coverage

Rule body

id: '9037.12149'
title: RDP Connection
description: 'This use case looks for when an RDP network connection has been established.
  -- Threat Actor Association: Agrius, APT35/Phosphorus/Magic Hound, Daixin Team,
  Flax Typhoon, Karakurt, Lapsus$, Muddled Libra, Scattered Spider (aka. 0ktapus,
  UNC3944), UNC5221, UTA0178 - Software Association: Akira, AvosLocker, BianLian,
  Blackcat/ALPHV, BlackByte, Lockbit, LV, Play, Quantum, Ransom Cartel, Rhysida, Royal,
  Snatch, Trigona'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (EventCode=5156 OR "Event>ID>5156<")
  (TERM(3389) OR TERM(RDP)) | table _time, host, user dest, direction, event_id, eventtype,
  parent_*, process, process_*, user, user_id, src_*, dest_* | bin span=1s | stats
  values(*) as * by _time, host | where match(dest_port, "(?i)3389|rdp") or match(src_port,
  "(?i)3389|rdp") '
techniques:
- lateral-movement:remote services:remote desktop protocol
- initial-access:external remote services
technique_id:
- T1021.001
- T1133
data_category:
- Windows event logs
references:
- https://www.group-ib.com/resources/threat-research/silence_moving-into-the-darkside.pdf

Stages and Predicates

Stage 1: search

`get_endpoint_data` `get_endpoint_data_winevent` (EventCode=5156 OR "Event>ID>5156<") (TERM(3389) OR TERM(RDP))

Stage 2: table

| table _time, host, user dest, direction, event_id, eventtype, parent_*, process, process_*, user, user_id, src_*, dest_*

Stage 3: bucket

| bin span=1s

Stage 4: stats

| stats values(*) as * by _time, host

Stage 5: where

| where match(dest_port, "(?i)3389|rdp") or match(src_port, "(?i)3389|rdp")

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
EventCodeeq
  • 5156 corpus 15 (splunk 13, kusto 2)
field:"EventID" kind:eq value:"5156"
dest_portregex_match
    • "(?i)3389
    • rdp"
    corpus 2 (splunk 2)
field:"DestinationPort" kind:regex_match
src_portregex_match
    • "(?i)3389
    • rdp"
    corpus 2 (splunk 2)
field:"SourcePort" kind:regex_match

Search terms

These SPL tokens match against raw event text.

StageTerm
1"Event>ID>5156<"
13389
1RDP