detection.wiki

Detection rules › Splunk

RDP Logon_Logoff Event (Windows Event Log)

Group by
_time, host
Source
github.com/anvilogic-forge/armory

This use case looks for Other Logon/Logoff Events, where an rdp logon/logoff event has occurred

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1133 External Remote Services
PersistenceT1133 External Remote Services
Lateral MovementT1021.001 Remote Services: Remote Desktop Protocol

References

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 4778A session was reconnected to a Window Station.
Security-AuditingEvent ID 4779A session was disconnected from a Window Station.

Rule body yaml

id: '9038.12147'
title: RDP Logon_Logoff Event
description: 'This use case looks for Other Logon/Logoff Events, where an rdp logon/logoff
  event has occurred. -- Threat Actor Association: Agrius, Daixin Team, Flax Typhoon,
  Karakurt, Muddled Libra, Scattered Spider (aka. 0ktapus, UNC3944), UNC5221, UTA0178
  - Software Association: Akira, AvosLocker, BianLian, Blackcat/ALPHV, BlackByte,
  Lockbit, LV, Play, Quantum, Rhysida, Royal, Snatch, Trigona'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (EventCode=4778 OR "Event>ID>4778<"
  OR EventCode=4779 OR "Event>ID>4779<") TERM(RDP) | table _time, host, user dest,
  direction, event_id, eventtype, parent_*, process, process_*, user, user_id, src_*,
  dest_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- lateral-movement:remote services:remote desktop protocol
- initial-access:external remote services
technique_id:
- T1021.001
- T1133
data_category:
- Windows event logs
references:
- https://www.group-ib.com/resources/threat-research/silence_moving-into-the-darkside.pdf

Stages and Predicates

Stage 1: search

`get_endpoint_data` `get_endpoint_data_winevent` (EventCode=4778 OR "Event>ID>4778<" OR EventCode=4779 OR "Event>ID>4779<") TERM(RDP)

Stage 2: table

| table _time, host, user dest, direction, event_id, eventtype, parent_*, process, process_*, user, user_id, src_*, dest_*

Stage 3: bucket

| bin span=1s

Stage 4: stats

| stats values(*) as * by _time, host

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 4778 corpus 2 (splunk 2)
  • 4779 corpus 3 (splunk 3)

Search terms

Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.

StageTerm
1"Event>ID>4778<"
1"Event>ID>4779<"
1TERM
1RDP