huntrule

Suspicious PowerShell Harvesting RDP Logon Events via Get-WinEvent

PremiumReviewedSigma · Medium · v1
Product
windows
Category
ps_script
Author
HuntRule
Published
2026-10-01
Updated
2026-10-01
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell using Get-WinEvent to harvest Terminal Services event ID 1149, which records successful RDP authentications, as seen in the r.ps1 script from a Qilin ransomware attack. Attackers mine these events to identify prior remote access sources and valid accounts for lateral movement. Bulk collection of RDP logon events is uncommon outside of forensic tooling.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious PowerShell Web Request to oastify Out-of-Band Domain
Suspicious PowerShell Execution of Untitled1 Script From ProgramData
Suspicious PowerShell Spawned by Komari Monitoring Agent
Suspicious Node Package Install Spawning Script Interpreters via process_creation
Suspicious PowerShell Spawned by ScreenConnect Remote Access Client
Suspicious SolarWinds Web Help Desk Java Process Spawning Command Shell
Malicious mshta Spawning PowerShell Loader via ClickFix
Suspicious Windows Script Host Spawning PowerShell via Gootloader
Suspicious PowerShell Spawned by Web Browser
Suspicious PowerShell Harvesting RDP Logon Events via Get-WinEvent
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.