Outbound RDP Connections Over Non-Standard Tools

Severity: high
Author: Markus Neis
Source: upstream

Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement. An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1021.001` Remote Services: Remote Desktop Protocol

Event coverage

Provider	Event ID	Title
Sysmon	3	Network connection

Stages and Predicates

Stage 1: `selection`

DestinationPort: 3389
Initiated: true

Stage 2: `not 1 of filter_main_mstsc`

Image: ['C:\Windows\SysWOW64\mstsc.exe', 'C:\Windows\System32\mstsc.exe']

Stage 3: `not 1 of filter_optional_*`

or:
Image: 'C:\Windows\System32\dns.exe'
Protocol: udp
SourcePort: 53
Image|endswith: '\Avast Software\Avast\AvastSvc.exe'
Image|endswith: '\Avast\AvastSvc.exe'
Image|endswith: '\FSAssessment.exe'
Image|endswith: '\FSDiscovery.exe'
Image|endswith: '\MobaRTE.exe'
Image|endswith: '\Passwordstate.exe'
Image|endswith: '\RDCMan.exe'
Image|endswith: '\RSSensor.exe'
Image|endswith: '\RTS2App.exe'
Image|endswith: '\RTSApp.exe'
Image|endswith: '\Ranger\SentinelRanger.exe'
Image|endswith: '\RemoteDesktopManager.exe'
Image|endswith: '\RemoteDesktopManager64.exe'
Image|endswith: '\RemoteDesktopManagerFree.exe'
Image|endswith: '\Terminals.exe'
Image|endswith: '\mRemote.exe'
Image|endswith: '\mRemoteNG.exe'
Image|endswith: '\spiceworks-finder.exe'
Image|endswith: '\thor.exe'
Image|endswith: '\thor64.exe'
Image|endswith: '\ws_TunnelService.exe'
Image: ''
Image: '<unknown process>'
Image: 'C:\Program Files (x86)\TSplus\Java\bin\HTML5service.exe'
Image: 'C:\Program Files\Google\Chrome\Application\chrome.exe'
Image: 'C:\Program Files\Mozilla Firefox\firefox.exe'
Image: 'C:\Program Files\TSplus\Java\bin\HTML5service.exe'
Image: null
Image|startswith: 'C:\Program Files\SplunkUniversalForwarder\bin\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`DestinationPort`	eq	`3389` corpus 3 (sigma 2, splunk 1)
`Image`	ends_with	`\Avast Software\Avast\AvastSvc.exe` `\Avast\AvastSvc.exe` `\FSAssessment.exe` `\FSDiscovery.exe` `\MobaRTE.exe` `\Passwordstate.exe` `\RDCMan.exe` corpus 2 (sigma 2) `\RSSensor.exe` `\RTS2App.exe` `\RTSApp.exe` `\Ranger\SentinelRanger.exe` `\RemoteDesktopManager.exe` `\RemoteDesktopManager64.exe` `\RemoteDesktopManagerFree.exe` `\Terminals.exe` `\mRemote.exe` `\mRemoteNG.exe` `\spiceworks-finder.exe` `\thor.exe` corpus 7 (sigma 7) `\thor64.exe` corpus 6 (sigma 6) `\ws_TunnelService.exe`
`Image`	eq	`<unknown process>` corpus 2 (sigma 2) `C:\Program Files (x86)\TSplus\Java\bin\HTML5service.exe` `C:\Program Files\Google\Chrome\Application\chrome.exe` corpus 12 (sigma 12) `C:\Program Files\Mozilla Firefox\firefox.exe` corpus 12 (sigma 12) `C:\Program Files\TSplus\Java\bin\HTML5service.exe` `C:\Windows\SysWOW64\mstsc.exe` `C:\Windows\System32\dns.exe` `C:\Windows\System32\mstsc.exe`
`Image`	starts_with	`C:\Program Files\SplunkUniversalForwarder\bin\`
`Initiated`	eq	`true` corpus 40 (sigma 40)
`Protocol`	eq	`udp`
`SourcePort`	eq	`53`