{"id":"5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4","title":"RDP Over Reverse SSH Tunnel","description":"Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389","author":"Samir Bousseaden","status":"test","level":"high","date":"2019-02-16","modified":"2024-03-12","tags":["attack.command-and-control","attack.t1572","attack.lateral-movement","attack.t1021.001","car.2013-07-002"],"technique_ids":["T1021.001","T1572"],"logsource":{"category":"network_connection","product":"windows"},"falsepositives":["Unknown"],"references":["https://twitter.com/cyb3rops/status/1096842275437625346"],"source_path":"rules/windows/network_connection/net_connection_win_rdp_reverse_tunnel.yml","source_sha256":"ba1f6039ec34a2c422cdde5bf52d42ce3e8ac434ab8bf6ce2eae22f2e95040ec","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_rdp_reverse_tunnel.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: RDP Over Reverse SSH Tunnel\nid: 5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4\nstatus: test\ndescription: Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389\nreferences:\n    - https://twitter.com/cyb3rops/status/1096842275437625346\nauthor: Samir Bousseaden\ndate: 2019-02-16\nmodified: 2024-03-12\ntags:\n    - attack.command-and-control\n    - attack.t1572\n    - attack.lateral-movement\n    - attack.t1021.001\n    - car.2013-07-002\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection_img:\n        Image|endswith: '\\svchost.exe'\n        Initiated: 'true'\n        SourcePort: 3389\n    selection_destination:\n        DestinationIp|cidr:\n            - '127.0.0.0/8'\n            - '::1/128'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1021.001","id":"T1021.001","name":"Remote Desktop Protocol","page":"techniques/enterprise/T1021.001/"},{"key":"enterprise/T1572","id":"T1572","name":"Protocol Tunneling","page":"techniques/enterprise/T1572/"}],"data_path":"data/detection-rules/5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4.json","kind":"sigma"}