T1021.001 Remote Desktop Protocol — Detection Rules

Source-backed rule directory

• OpenCanary - RDP New Connection Attempt · experimental · high · {"category":"application","product":"opencanary"}
• Publicly Accessible RDP Service · test · high · {"product":"zeek","service":"rdp"}
• RDP Login from Localhost · test · high · {"product":"windows","service":"security"}
• Denied Access To Remote Desktop · test · medium · {"product":"windows","service":"security"}
• RDP over Reverse SSH Tunnel WFP · test · high · {"product":"windows","service":"security"}
• Outbound RDP Connections Over Non-Standard Tools · test · high · {"category":"network_connection","product":"windows"}
• RDP Over Reverse SSH Tunnel · test · high · {"category":"network_connection","product":"windows"}
• RDP to HTTP or HTTPS Target Ports · test · high · {"category":"network_connection","product":"windows"}
• New Remote Desktop Connection Initiated Via Mstsc.EXE · test · medium · {"category":"process_creation","product":"windows"}
• Suspicious Plink Port Forwarding · test · high · {"category":"process_creation","product":"windows"}
• RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class · experimental · medium · {"category":"process_creation","product":"windows"}
• Potential Tampering With RDP Related Registry Keys Via Reg.EXE · test · high · {"product":"windows","category":"process_creation"}
• Port Forwarding Activity Via SSH.EXE · test · medium · {"category":"process_creation","product":"windows"}
• User Added to Remote Desktop Users Group · test · high · {"category":"process_creation","product":"windows"}
• Suspicious RDP Redirect Using TSCON · test · high · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1021.001 Remote Desktop Protocol

MATCH(successful_rdp_session) AND source_host NOT_IN approved_rdp_sources -> ALERT

• Remote Desktop and Remote Support Logs
• Windows Security Event Logs
• Network Flow Logs
• Atlas source section

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0327 Multi-event Detection Strategy for RDP-Based Remote Logins and Post-Access Activity

AN0931 Analytic 0931

Remote Desktop (RDP) logon by a user followed by unusual process execution, file access, or lateral movement activity within a short timeframe.