Elastic Defend high stable eql

Potential Initial Access via Rogue RDP Server

Identifies attempts to drop an executable file via a malicious RDP connection file. This may indicate an attempt to get initial access by connecting to an adversary controlled malicious RDP server.

View Source

Detection Logic

sequence by process.entity_id with maxspan=5m
 [process where event.action == "start" and process.name : "mstsc.exe" and process.args_count >= 2 and
  not (process.args : "-Embedding" and process.parent.name : "svchost.exe") and
  not process.parent.executable :
             ("?:\\Program Files\\Thycotic Software Ltd\\Secret Server Protocol Handler\\RDPWin.exe",
              "?:\\Program Files (x86)\\Thycotic Software Ltd\\Secret Server Protocol Handler\\RDPWin.exe")]
 [network where event.action == "connection_attempted" and process.name : "mstsc.exe"]
 [file where event.action != "deletion" and process.name : "mstsc.exe" and 
  (
   (file.extension : ("dll", "exe", "cpl", "pif", "com", "js", "vbs", "wsh", "vbe", "jse", "bat", "cmd") or
    file.Ext.header_bytes : "4d5a*" or file.name : "*.exe.config") or

   file.path : ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
               "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*",
               "?:\\Users\\*\\Desktop\\*.lnk")
   ) and
   not file.path : ("?:\\*\\AppData\\Local\\Temp\\*", "?:\\Program Files*") and
   not (file.path : "?:\\ProgramData\\*" and not file.path : "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*")]

Field Validations

Loading…

Comments (0)

Loading comments...