Potential Remote Desktop Tunneling

Back


Id	d2e8fd50-8d66-11ec-b909-0242ac120002
Rulename	Potential Remote Desktop Tunneling
Description	This query detects remote desktop authentication attempts with a localhost source address, which can indicate a tunneled login. Ref: https://www.mandiant.com/resources/bypassing-network-restrictions-through-rdp-tunneling
Severity	Medium
Tactics	CommandAndControl
Techniques	T1572
Required data connectors	SecurityEvents WindowsSecurityEvents
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Endpoint Threat Protection Essentials/Analytic Rules/PotentialRemoteDesktopTunneling.yaml
Version	1.0.4
Arm template	d2e8fd50-8d66-11ec-b909-0242ac120002.json

KQL

SecurityEvent
   | where EventID in (4624,4625) and LogonType in (10) and IpAddress in ("::1","127.0.0.1")
   | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, TargetUserName, TargetLogonId, LogonType, IpAddress
   | extend Name=tostring(split(TargetUserName, "@")[0]), UPNSuffix=tostring(split(TargetUserName, "@")[1])
   | extend HostName = iif(Computer has '.',substring(Computer,0,indexof(Computer,'.')),Computer) , DnsDomain = iif(Computer has '.',substring(Computer,indexof(Computer,'.')+1),'')

YAML

kind: Scheduled
queryFrequency: 1h
queryPeriod: 1h
status: Available
tactics:
- CommandAndControl
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Endpoint Threat Protection Essentials/Analytic Rules/PotentialRemoteDesktopTunneling.yaml
version: 1.0.4
triggerThreshold: 0
description: |
  'This query detects remote desktop authentication attempts with a localhost source address, which can indicate a tunneled login.
  Ref: https://www.mandiant.com/resources/bypassing-network-restrictions-through-rdp-tunneling'  
severity: Medium
relevantTechniques:
- T1572
id: d2e8fd50-8d66-11ec-b909-0242ac120002
name: Potential Remote Desktop Tunneling
requiredDataConnectors:
- dataTypes:
  - SecurityEvent
  connectorId: SecurityEvents
- dataTypes:
  - SecurityEvent
  connectorId: WindowsSecurityEvents
query: |
  SecurityEvent
     | where EventID in (4624,4625) and LogonType in (10) and IpAddress in ("::1","127.0.0.1")
     | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, TargetUserName, TargetLogonId, LogonType, IpAddress
     | extend Name=tostring(split(TargetUserName, "@")[0]), UPNSuffix=tostring(split(TargetUserName, "@")[1])
     | extend HostName = iif(Computer has '.',substring(Computer,0,indexof(Computer,'.')),Computer) , DnsDomain = iif(Computer has '.',substring(Computer,indexof(Computer,'.')+1),'')  
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: Name
  - identifier: UPNSuffix
    columnName: UPNSuffix
  entityType: Account
- fieldMappings:
  - identifier: FullName
    columnName: Computer
  - identifier: HostName
    columnName: HostName
  - identifier: DnsDomain
    columnName: DnsDomain
  entityType: Host
- fieldMappings:
  - identifier: Address
    columnName: IpAddress
  entityType: IP
triggerOperator: gt

ARM