Windows Process Creation: SSH Port-Forwarding Commands Targeting RDP (3389)

title: "Windows Process Creation: SSH Port-Forwarding Commands Targeting RDP (3389)"
id: 63d71788-7a05-43e6-a156-ca26a71afc7c
status: test
description: This rule flags Windows process creation events where the command line includes the RDP port indicator ':3389' along with common SSH port-forwarding related switches. Attackers can use SSH tunnels to forward or route RDP traffic through intermediate hosts, helping them reach systems that would otherwise be unreachable. The detection relies on process command-line telemetry to identify these tunneling patterns.
references:
  - https://www.elastic.co/guide/en/security/current/potential-remote-desktop-tunneling-detected.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_remote_desktop_tunneling.yml
author: Tim Rauch, Elastic (idea), Huntrule Team
date: 2022-09-27
tags:
  - attack.lateral-movement
  - attack.t1021
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: :3389
  selection_opt:
    CommandLine|contains:
      - " -L "
      - " -P "
      - " -R "
      - " -pw "
      - " -ssh "
  condition: all of selection*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 8a3038e8-9c9d-46f8-b184-66234a160f6f
    type: derived