Windows External Remote Login (Windows Event Log)

Source: github.com/anvilogic-forge/armory

Detect when a remote logon connection is made from an external ip address

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1021.001` Remote Services: Remote Desktop Protocol

References

https://dfironthemountain.wordpress.com/2019/02/15/rdp-event-log-dfir/

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4624: An account was successfully logged on.

Rule body

id: '8366.10476'
title: Windows External Remote Login
description: 'Detect when a remote logon connection is made from an external ip address.
  -- Threat Actor Association: LUCR-3, Scattered Spider (aka. 0ktapus, UNC3944), Volt
  Typhoon - Software Association: PYSA/Mespinoza'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4624) OR
  "<EventID>4624<") Logon_Type=10 | search NOT src_ip IN (10.0.0.0/8, 127.0.0.0/8,
  169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, 224.0.0.0/4, 255.255.255.255, "::1",
  "FE80::/10", "FF00::/8", "0.0.0.0") | iplocation src_ip| rename Country as country
  | table _time, host, user process, signature_id, src_ip, process_name, country |
  bin span=1s | stats values(*) as * by _time, host '
techniques:
- lateral-movement:remote services:remote desktop protocol
- lateral-movement:remote services
technique_id:
- T1021.001
- T1021
data_category:
- Windows event logs
references:
- https://dfironthemountain.wordpress.com/2019/02/15/rdp-event-log-dfir/