{"id":"ed74fe75-7594-4b4b-ae38-e38e3fd2eb23","title":"Outbound RDP Connections Over Non-Standard Tools","description":"Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement.\nAn initial baseline is required before using this utility to exclude third party RDP tooling that you might use.\n","author":"Markus Neis","status":"test","level":"high","date":"2019-05-15","modified":"2024-02-09","tags":["attack.lateral-movement","attack.t1021.001","car.2013-07-002"],"technique_ids":["T1021.001"],"logsource":{"category":"network_connection","product":"windows"},"falsepositives":["Third party RDP tools"],"references":["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708"],"source_path":"rules/windows/network_connection/net_connection_win_rdp_outbound_over_non_standard_tools.yml","source_sha256":"412709e0797b76fc0cdfa6dc73b94aed6ddb09593d1dc867c230021a7c040635","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_rdp_outbound_over_non_standard_tools.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Outbound RDP Connections Over Non-Standard Tools\nid: ed74fe75-7594-4b4b-ae38-e38e3fd2eb23\nstatus: test\ndescription: |\n    Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement.\n    An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.\nreferences:\n    - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708\nauthor: Markus Neis\ndate: 2019-05-15\nmodified: 2024-02-09\ntags:\n    - attack.lateral-movement\n    - attack.t1021.001\n    - car.2013-07-002\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        DestinationPort: 3389\n        Initiated: 'true'\n    filter_main_mstsc:\n        Image:\n            - 'C:\\Windows\\System32\\mstsc.exe'\n            - 'C:\\Windows\\SysWOW64\\mstsc.exe'\n    filter_optional_dns:\n        # Note: https://github.com/SigmaHQ/sigma/pull/2249\n        Image: 'C:\\Windows\\System32\\dns.exe'\n        SourcePort: 53\n        Protocol: 'udp'\n    filter_optional_avast:\n        Image|endswith:\n            - '\\Avast Software\\Avast\\AvastSvc.exe'\n            - '\\Avast\\AvastSvc.exe'\n    filter_optional_sysinternals_rdcman:\n        Image|endswith: '\\RDCMan.exe'\n    filter_optional_chrome:\n        Image: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe'\n    filter_optional_third_party:\n        Image|endswith:\n            - '\\FSAssessment.exe'\n            - '\\FSDiscovery.exe'\n            - '\\MobaRTE.exe'\n            - '\\mRemote.exe'\n            - '\\mRemoteNG.exe'\n            - '\\Passwordstate.exe'\n            - '\\RemoteDesktopManager.exe'\n            - '\\RemoteDesktopManager64.exe'\n            - '\\RemoteDesktopManagerFree.exe'\n            - '\\RSSensor.exe'\n            - '\\RTS2App.exe'\n            - '\\RTSApp.exe'\n            - '\\spiceworks-finder.exe'\n            - '\\Terminals.exe'\n            - '\\ws_TunnelService.exe'\n    filter_optional_thor:\n        Image|endswith:\n            - '\\thor.exe'\n            - '\\thor64.exe'\n    filter_optional_splunk:\n        Image|startswith: 'C:\\Program Files\\SplunkUniversalForwarder\\bin\\'\n    filter_optional_sentinel_one:\n        Image|endswith: '\\Ranger\\SentinelRanger.exe'\n    filter_optional_firefox:\n        Image: 'C:\\Program Files\\Mozilla Firefox\\firefox.exe'\n    filter_optional_tsplus:  # Some RAS\n        Image:\n            - 'C:\\Program Files\\TSplus\\Java\\bin\\HTML5service.exe'\n            - 'C:\\Program Files (x86)\\TSplus\\Java\\bin\\HTML5service.exe'\n    filter_optional_null:\n        Image: null\n    filter_optional_empty:\n        Image: ''\n    filter_optional_unknown:\n        Image: '<unknown process>'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Third party RDP tools\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1021.001","id":"T1021.001","name":"Remote Desktop Protocol","page":"techniques/enterprise/T1021.001/"}],"data_path":"data/detection-rules/ed74fe75-7594-4b4b-ae38-e38e3fd2eb23.json","kind":"sigma"}