Detection rules › Splunk
RDP Hijacking (Windows Event Log)
Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS)
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1133 External Remote Services |
| Persistence | T1133 External Remote Services |
| Lateral Movement | T1563.002 Remote Service Session Hijacking: RDP Hijacking |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Security-Auditing | Event ID 4778 | A session was reconnected to a Window Station. |
| Security-Auditing | Event ID 4779 | A session was disconnected from a Window Station. |
Rule body yaml
id: '5464.5627'
title: RDP Hijacking
description: 'Adversaries may hijack a legitimate user’s remote desktop session to
move laterally within an environment. Remote desktop is a common feature in operating
systems. It allows a user to log into an interactive session with a system desktop
graphical user interface on a remote system. Microsoft refers to its implementation
of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS) - Threat Actor
Association: APT10, APT27, APT29/Nobelium/Cozy Bear, APT31, APT41, BlackMatter,
Carbanak, DarkSide, DragonFly, FIN6, Lazarus, Whisper Spider, Wizard Spider, UNC2628,
UNC2596 - Software Association: Bazarloader, BlackByte, BlackMatter, Conti, Cuba,
Dharma, Diavol, Lockbit, LV, Midas, PYSA/Mespinoza, Snatch'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4778) OR
"<EventID>4778<" OR TERM(EventCode=4779) OR "<EventID>4779<") OR (("rdpclip.exe"
OR "tstheme.exe") (TERM(EventCode=4688) OR "<EventID>4688<")) | table _time, host,
user, signature_id, src_ip, process, process_id, process_name, parent_process_name
`group_events("host",5m)`| eventstats dc(user) as users by user | where (match(signature_id,
"(?i)4778") AND match(signature_id, "(?i)4779") AND match(process_name, "(?i)rdpclip.exe")
AND match(process_name, "(?i)tstheme.exe")) AND users>=2 | lookup dnslookup clientip
as src_ip OUTPUT clienthost as src_dns | iplocation prefix="src_" src_ip| rename
src_Country as src_country '
techniques:
- initial-access:external remote services
- lateral-movement:remote service session hijacking:rdp hijacking
technique_id:
- T1133
- T1563.002
data_category:
- Windows event logs
references:
- https://www.hackingarticles.in/rdp-session-hijacking-with-tscon/
- https://www.ired.team/offensive-security/lateral-movement/t1076-rdp-hijacking-for-lateral-movement
Stages and Predicates
Stage 1: search
search ((EventCode=4778 EventCode=4779) OR EventCode=4688) source="*" source IN ("WinEventLog:Security", "XmlWinEventLog:Security")
Stage 2: table
table _time, host, parent_process_name, process, process_id, process_name, signature_id, src_ip, user
Stage 3: bucket
bucket _time
Stage 4: stats
stats BY host, _time
Stage 5: eventstats
eventstats … AS users BY user
Stage 6: where
where process_name="*(?i)rdpclip.exe*" process_name="*(?i)tstheme.exe*" signature_id="*(?i)4778*" signature_id="*(?i)4779*" users>=2
Stage 7: lookup
lookup <lookup> clienthost, clientip, src_dns, src_ip
Stage 8: search
search prefix="src_"
Stage 9: rename
rename
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
prefix | eq |
|
process_name | match |
|
signature_id | match |
|
users | ge |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4778<" |
| 1 | TERM |
| 1 | "<EventID>4779<" |
| 1 | "rdpclip.exe" |
| 1 | "tstheme.exe" |
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 8 | iplocation |
| 8 | src_ip |