{"id":"259a9cdf-c4dd-4fa2-b243-2269e5ab18a2","title":"External Remote RDP Logon from Public IP","description":"Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.","author":"Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)","status":"test","level":"medium","date":"2023-01-19","modified":"2024-03-11","tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.credential-access","attack.stealth","attack.t1133","attack.t1078","attack.t1110"],"technique_ids":["T1078","T1110","T1133"],"logsource":{"product":"windows","service":"security"},"falsepositives":["Legitimate or intentional inbound connections from public IP addresses on the RDP port."],"references":["https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html","https://twitter.com/Purp1eW0lf/status/1616144561965002752"],"source_path":"rules/windows/builtin/security/account_management/win_security_successful_external_remote_rdp_login.yml","source_sha256":"39e0573c1af9fbdb767afe001b512e9f55bde300dc04e9bb5f3f1f3a5c140d3d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/account_management/win_security_successful_external_remote_rdp_login.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: External Remote RDP Logon from Public IP\nid: 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2\nrelated:\n    - id: 78d5cab4-557e-454f-9fb9-a222bd0d5edc\n      type: derived\nstatus: test\ndescription: Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.\nreferences:\n    - https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html\n    - https://twitter.com/Purp1eW0lf/status/1616144561965002752\nauthor: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)\ndate: 2023-01-19\nmodified: 2024-03-11\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.initial-access\n    - attack.credential-access\n    - attack.stealth\n    - attack.t1133\n    - attack.t1078\n    - attack.t1110\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4624\n        LogonType: 10\n    filter_main_local_ranges:\n        IpAddress|cidr:\n            - '::1/128'  # IPv6 loopback\n            - '10.0.0.0/8'\n            - '127.0.0.0/8'\n            - '172.16.0.0/12'\n            - '192.168.0.0/16'\n            - '169.254.0.0/16'\n            - 'fc00::/7'  # IPv6 private addresses\n            - 'fe80::/10'  # IPv6 link-local addresses\n    filter_main_empty:\n        IpAddress: '-'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Legitimate or intentional inbound connections from public IP addresses on the RDP port.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1078","id":"T1078","name":"Valid Accounts","page":"techniques/enterprise/T1078/"},{"key":"enterprise/T1110","id":"T1110","name":"Brute Force","page":"techniques/enterprise/T1110/"},{"key":"enterprise/T1133","id":"T1133","name":"External Remote Services","page":"techniques/enterprise/T1133/"}],"data_path":"data/detection-rules/259a9cdf-c4dd-4fa2-b243-2269e5ab18a2.json","kind":"sigma"}