Potential Remote Desktop Tunneling

Back


Id	d2e8fd50-8d66-11ec-b909-0242ac120002
Rulename	Potential Remote Desktop Tunneling
Description	This query detects remote desktop authentication attempts with a localhost source address, which can indicate a tunneled login. Ref: https://www.mandiant.com/resources/bypassing-network-restrictions-through-rdp-tunneling
Severity	Medium
Tactics	CommandAndControl
Techniques	T1572
Required data connectors	SecurityEvents WindowsSecurityEvents
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Endpoint Threat Protection Essentials/Analytic Rules/PotentialRemoteDesktopTunneling.yaml
Version	1.0.4
Arm template	d2e8fd50-8d66-11ec-b909-0242ac120002.json

KQL

SecurityEvent
   | where EventID in (4624,4625) and LogonType in (10) and IpAddress in ("::1","127.0.0.1")
   | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, TargetUserName, TargetLogonId, LogonType, IpAddress
   | extend Name=tostring(split(TargetUserName, "@")[0]), UPNSuffix=tostring(split(TargetUserName, "@")[1])
   | extend HostName = iif(Computer has '.',substring(Computer,0,indexof(Computer,'.')),Computer) , DnsDomain = iif(Computer has '.',substring(Computer,indexof(Computer,'.')+1),'')

YAML

query: |
  SecurityEvent
     | where EventID in (4624,4625) and LogonType in (10) and IpAddress in ("::1","127.0.0.1")
     | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, TargetUserName, TargetLogonId, LogonType, IpAddress
     | extend Name=tostring(split(TargetUserName, "@")[0]), UPNSuffix=tostring(split(TargetUserName, "@")[1])
     | extend HostName = iif(Computer has '.',substring(Computer,0,indexof(Computer,'.')),Computer) , DnsDomain = iif(Computer has '.',substring(Computer,indexof(Computer,'.')+1),'')  
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: Name
    identifier: Name
  - columnName: UPNSuffix
    identifier: UPNSuffix
- entityType: Host
  fieldMappings:
  - columnName: Computer
    identifier: FullName
  - columnName: HostName
    identifier: HostName
  - columnName: DnsDomain
    identifier: DnsDomain
- entityType: IP
  fieldMappings:
  - columnName: IpAddress
    identifier: Address
triggerThreshold: 0
name: Potential Remote Desktop Tunneling
severity: Medium
relevantTechniques:
- T1572
queryPeriod: 1h
tactics:
- CommandAndControl
requiredDataConnectors:
- connectorId: SecurityEvents
  dataTypes:
  - SecurityEvent
- connectorId: WindowsSecurityEvents
  dataTypes:
  - SecurityEvent
queryFrequency: 1h
version: 1.0.4
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Endpoint Threat Protection Essentials/Analytic Rules/PotentialRemoteDesktopTunneling.yaml
id: d2e8fd50-8d66-11ec-b909-0242ac120002
kind: Scheduled
description: |
  'This query detects remote desktop authentication attempts with a localhost source address, which can indicate a tunneled login.
  Ref: https://www.mandiant.com/resources/bypassing-network-restrictions-through-rdp-tunneling'  
status: Available
triggerOperator: gt

ARM