ID | Technique | Tactic |
---|---|---|
T1563.002 | RDP Hijacking | Lateral Movement |
Detection: Windows RDP Connection Successful
Description
The following analytic detects successful Remote Desktop Protocol (RDP) connections by monitoring EventCode 1149 from the Windows TerminalServices RemoteConnectionManager Operational log. This detection is significant as successful RDP connections can indicate remote access to a system, which may be leveraged by attackers to control or exfiltrate data. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further lateral movement within the network. Monitoring successful RDP connections is crucial for identifying potential security breaches and mitigating risks promptly.
Search
1`remoteconnectionmanager` EventCode=1149
2| stats count min(_time) as firstTime max(_time) as lastTime by Computer, user_id
3| `security_content_ctime(firstTime)`
4| `security_content_ctime(lastTime)`
5| rename Computer as dest
6| `windows_rdp_connection_successful_filter`
Data Source
Name | Platform | Sourcetype | Source |
---|---|---|---|
Windows Event Log RemoteConnectionManager 1149 | Windows | 'wineventlog' |
'WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational' |
Macros Used
Name | Value |
---|---|
remoteconnectionmanager | source="WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" |
windows_rdp_connection_successful_filter | search * |
windows_rdp_connection_successful_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Risk Event | False |
Implementation
The following analyic requires the WIndows TerminalServices RemoteConnectionManager Operational log to be enabled and ingested into Splunk. For the inputs, review https://gist.github.com/MHaggis/138c6bf563bacbda4a2524f089773706.
Known False Positives
False positives will be present, filter as needed or restrict to critical assets on the perimeter.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
A successful RDP connection on $dest$ occurred. | 25 | 50 | 50 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational |
XmlWinEventLog |
Integration | ✅ Passing | Dataset | WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational |
XmlWinEventLog |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 4