Potential Remote Desktop Tunneling

Back


Id	d2e8fd50-8d66-11ec-b909-0242ac120002
Rulename	Potential Remote Desktop Tunneling
Description	This query detects remote desktop authentication attempts with a localhost source address, which can indicate a tunneled login. Ref: https://www.mandiant.com/resources/bypassing-network-restrictions-through-rdp-tunneling
Severity	Medium
Tactics	CommandAndControl
Techniques	T1572
Required data connectors	SecurityEvents WindowsSecurityEvents
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Endpoint Threat Protection Essentials/Analytic Rules/PotentialRemoteDesktopTunneling.yaml
Version	1.0.4
Arm template	d2e8fd50-8d66-11ec-b909-0242ac120002.json

KQL

SecurityEvent
   | where EventID in (4624,4625) and LogonType in (10) and IpAddress in ("::1","127.0.0.1")
   | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, TargetUserName, TargetLogonId, LogonType, IpAddress
   | extend Name=tostring(split(TargetUserName, "@")[0]), UPNSuffix=tostring(split(TargetUserName, "@")[1])
   | extend HostName = iif(Computer has '.',substring(Computer,0,indexof(Computer,'.')),Computer) , DnsDomain = iif(Computer has '.',substring(Computer,indexof(Computer,'.')+1),'')

YAML

tactics:
- CommandAndControl
query: |
  SecurityEvent
     | where EventID in (4624,4625) and LogonType in (10) and IpAddress in ("::1","127.0.0.1")
     | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, TargetUserName, TargetLogonId, LogonType, IpAddress
     | extend Name=tostring(split(TargetUserName, "@")[0]), UPNSuffix=tostring(split(TargetUserName, "@")[1])
     | extend HostName = iif(Computer has '.',substring(Computer,0,indexof(Computer,'.')),Computer) , DnsDomain = iif(Computer has '.',substring(Computer,indexof(Computer,'.')+1),'')  
requiredDataConnectors:
- dataTypes:
  - SecurityEvent
  connectorId: SecurityEvents
- dataTypes:
  - SecurityEvent
  connectorId: WindowsSecurityEvents
name: Potential Remote Desktop Tunneling
kind: Scheduled
queryPeriod: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Endpoint Threat Protection Essentials/Analytic Rules/PotentialRemoteDesktopTunneling.yaml
triggerThreshold: 0
description: |
  'This query detects remote desktop authentication attempts with a localhost source address, which can indicate a tunneled login.
  Ref: https://www.mandiant.com/resources/bypassing-network-restrictions-through-rdp-tunneling'  
version: 1.0.4
status: Available
queryFrequency: 1h
severity: Medium
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: Name
  - identifier: UPNSuffix
    columnName: UPNSuffix
- entityType: Host
  fieldMappings:
  - identifier: FullName
    columnName: Computer
  - identifier: HostName
    columnName: HostName
  - identifier: DnsDomain
    columnName: DnsDomain
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IpAddress
triggerOperator: gt
id: d2e8fd50-8d66-11ec-b909-0242ac120002
relevantTechniques:
- T1572

ARM