Detection rules › Splunk

Windows Default RDP File Creation By Non MSTSC Process

Author
Teoderick Contreras, Splunk
Source
upstream

This detection monitors the creation or modification of the Default.rdp file by non mstsc.exe process, typically found in the user's Documents folder. This file is automatically generated or updated by the Remote Desktop Connection client (mstsc.exe) when a user initiates an RDP session. It stores connection settings such as the last-used hostname, screen size, and other preferences. The presence or update of this file strongly suggests that an RDP session has been launched from the system. Since this file is commonly overlooked, it can serve as a valuable artifact in identifying remote access activity, including potential lateral movement or attacker-controlled sessions.

MITRE ATT&CK coverage

TacticTechniques
Lateral MovementT1021.001 Remote Services: Remote Desktop Protocol

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Sysmon11FileCreate

Stages and Predicates

Stage 1: tstats

tstats WHERE Processes.process_name!="mstsc.exe" BY _time, Processes.action, Processes.dest, Processes.original_file_name, Processes.parent_process, Processes.parent_process_exec, Processes.parent_process_guid, Processes.parent_process_id, Processes.parent_process_name, Processes.parent_process_path, Processes.process, Processes.process_exec, Processes.process_guid, Processes.process_hash, Processes.process_id, Processes.process_integrity_level, Processes.process_name, Processes.process_path, Processes.user, Processes.user_id, Processes.vendor_product

Stage 2: search

search

Stage 3: rename

rename

Stage 4: join

join type=inner (...)

Stage 5: dedup

dedup file_create_time

Stage 6: table

table dest, file_create_time, file_name, file_path, proc_guid, process, process_name

Stage 7: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Filesystem.file_nameeq
  • default.rdp
Processes.process_namene
  • mstsc.exe