Denied Access To Remote Desktop — Sigma Rule

Rule metadata and linked tags

Author: Pushkarev Dmitry. Source status: test; severity: medium. Source dates: 2020-06-27 / 2021-11-27.

{
  "product": "windows",
  "service": "security"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 62c14390efdac85646547b1e1deed83b35ff6059e64dc3e61be8027f512f97b1

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Denied Access To Remote Desktop
id: 8e5c03fa-b7f0-11ea-b242-07e0576828d9
status: test
description: |
  This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop.
  Often, this event can be generated by attackers when searching for available windows servers in the network.
references:
    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4825
author: Pushkarev Dmitry
date: 2020-06-27
modified: 2021-11-27
tags:
    - attack.lateral-movement
    - attack.t1021.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4825
    condition: selection
falsepositives:
    - Valid user was not added to RDP group
level: medium

Original YAML and metadata in JSON

False positives

• Valid user was not added to RDP group

Source references

• https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4825