Detection rules › Sigma

Potential Remote Desktop Connection to Non-Domain Host

Severity
medium
Author
James Pemberton
Source
upstream

Detects logons using NTLM to hosts that are potentially not part of the domain.

MITRE ATT&CK coverage

TacticTechniques
Command & ControlT1219.002 Remote Access Tools: Remote Desktop Software

Event coverage

ProviderEvent IDTitle
NTLM8001NTLM client blocked audit: Audit outgoing NTLM authentication traffic that would be blocked.

Stages and Predicates

Stage 1: selection

TargetName|startswith: TERMSRV

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetNamestarts_with
  • TERMSRV