{"id":"8e5c03fa-b7f0-11ea-b242-07e0576828d9","title":"Denied Access To Remote Desktop","description":"This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop.\nOften, this event can be generated by attackers when searching for available windows servers in the network.\n","author":"Pushkarev Dmitry","status":"test","level":"medium","date":"2020-06-27","modified":"2021-11-27","tags":["attack.lateral-movement","attack.t1021.001"],"technique_ids":["T1021.001"],"logsource":{"product":"windows","service":"security"},"falsepositives":["Valid user was not added to RDP group"],"references":["https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4825"],"source_path":"rules/windows/builtin/security/win_security_not_allowed_rdp_access.yml","source_sha256":"62c14390efdac85646547b1e1deed83b35ff6059e64dc3e61be8027f512f97b1","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_not_allowed_rdp_access.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Denied Access To Remote Desktop\nid: 8e5c03fa-b7f0-11ea-b242-07e0576828d9\nstatus: test\ndescription: |\n  This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop.\n  Often, this event can be generated by attackers when searching for available windows servers in the network.\nreferences:\n    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4825\nauthor: Pushkarev Dmitry\ndate: 2020-06-27\nmodified: 2021-11-27\ntags:\n    - attack.lateral-movement\n    - attack.t1021.001\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4825\n    condition: selection\nfalsepositives:\n    - Valid user was not added to RDP group\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1021.001","id":"T1021.001","name":"Remote Desktop Protocol","page":"techniques/enterprise/T1021.001/"}],"data_path":"data/detection-rules/8e5c03fa-b7f0-11ea-b242-07e0576828d9.json","kind":"sigma"}