Windows NTLM Logon to TERMSRV Target Not Domain-Associated Host

Alerts on Windows NTLM events tied to TERMSRV targets that may be non-domain hosts, suggesting potential RDP access.

FreeUnreviewedSigmamediumv1

windows-ntlm-logon-to-termsrv-target-not-domain-associated-host-ce5678bb

title: Windows NTLM Logon to TERMSRV Target Not Domain-Associated Host
id: ff7b0cc4-c352-4c88-beb9-64be396d5bd3
status: test
description: This rule flags Windows NTLM-related activity where the target service begins with TERMSRV, indicating a potential Remote Desktop (RDP) session setup. Attackers may use RDP to establish interactive access, including from hosts that are not part of the expected domain trust boundaries. It relies on Microsoft-Windows-NTLM/Operational events containing EventID 8001 and the TargetName field.
references:
  - n/a
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/ntlm/win_susp_ntlm_rdp.yml
author: James Pemberton, Huntrule Team
date: 2020-05-22
modified: 2021-11-27
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  product: windows
  service: ntlm
  definition: Requires events from Microsoft-Windows-NTLM/Operational
detection:
  selection:
    EventID: 8001
    TargetName|startswith: TERMSRV
  condition: selection
falsepositives:
  - Host connections to valid domains, exclude these.
  - Host connections not using host FQDN.
  - Host connections to external legitimate domains.
level: medium
license: DRL-1.1
related:
  - id: ce5678bb-b9aa-4fb5-be4b-e57f686256ad
    type: derived

What it detects

This rule flags Windows NTLM-related activity where the target service begins with TERMSRV, indicating a potential Remote Desktop (RDP) session setup. Attackers may use RDP to establish interactive access, including from hosts that are not part of the expected domain trust boundaries. It relies on Microsoft-Windows-NTLM/Operational events containing EventID 8001 and the TargetName field.

Known false positives

Host connections to valid domains, exclude these.
Host connections not using host FQDN.
Host connections to external legitimate domains.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.