Windows Outbound RDP Sessions to Port 3389 Initiated by Non-Standard Processes

title: Windows Outbound RDP Sessions to Port 3389 Initiated by Non-Standard Processes
id: 875dd0c7-e882-4463-88c1-3ea4790de906
status: test
description: This rule flags outbound network connections to destination port 3389 that are marked as initiated while the source process is not one of several commonly used RDP-related binaries. Attackers may use alternative remote access tools for lateral movement or remote management, so filtering out expected Microsoft mstsc.exe and a set of known third-party clients helps surface unusual activity. It relies on Windows network connection telemetry including destination port, an initiated indicator, and the connecting process image path for allowlisting and exclusion.
references:
  - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_rdp_outbound_over_non_standard_tools.yml
author: Markus Neis, Huntrule Team
date: 2019-05-15
modified: 2024-02-09
tags:
  - attack.lateral-movement
  - attack.t1021.001
  - car.2013-07-002
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 3389
    Initiated: "true"
  filter_main_mstsc:
    Image:
      - C:\Windows\System32\mstsc.exe
      - C:\Windows\SysWOW64\mstsc.exe
  filter_optional_dns:
    Image: C:\Windows\System32\dns.exe
    SourcePort: 53
    Protocol: udp
  filter_optional_avast:
    Image|endswith:
      - \Avast Software\Avast\AvastSvc.exe
      - \Avast\AvastSvc.exe
  filter_optional_sysinternals_rdcman:
    Image|endswith: \RDCMan.exe
  filter_optional_chrome:
    Image: C:\Program Files\Google\Chrome\Application\chrome.exe
  filter_optional_third_party:
    Image|endswith:
      - \FSAssessment.exe
      - \FSDiscovery.exe
      - \MobaRTE.exe
      - \mRemote.exe
      - \mRemoteNG.exe
      - \Passwordstate.exe
      - \RemoteDesktopManager.exe
      - \RemoteDesktopManager64.exe
      - \RemoteDesktopManagerFree.exe
      - \RSSensor.exe
      - \RTS2App.exe
      - \RTSApp.exe
      - \spiceworks-finder.exe
      - \Terminals.exe
      - \ws_TunnelService.exe
  filter_optional_thor:
    Image|endswith:
      - \thor.exe
      - \thor64.exe
  filter_optional_splunk:
    Image|startswith: C:\Program Files\SplunkUniversalForwarder\bin\
  filter_optional_sentinel_one:
    Image|endswith: \Ranger\SentinelRanger.exe
  filter_optional_firefox:
    Image: C:\Program Files\Mozilla Firefox\firefox.exe
  filter_optional_tsplus:
    Image:
      - C:\Program Files\TSplus\Java\bin\HTML5service.exe
      - C:\Program Files (x86)\TSplus\Java\bin\HTML5service.exe
  filter_optional_null:
    Image: null
  filter_optional_empty:
    Image: ""
  filter_optional_unknown:
    Image: <unknown process>
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Third party RDP tools
level: high
license: DRL-1.1
related:
  - id: ed74fe75-7594-4b4b-ae38-e38e3fd2eb23
    type: derived