Windows: .rdp File Creation Triggered by Uncommon Application

title: "Windows: .rdp File Creation Triggered by Uncommon Application"
id: bc26bee9-c7d3-4dd7-b001-e50a7f1a707c
related:
  - id: f748c45a-f8d3-4e6f-b617-fe176f695b8f
    type: derived
  - id: fccfb43e-09a7-4bd2-8b37-a5a7df33386d
    type: derived
status: test
description: This rule flags Windows file creation events for filenames ending in .rdp when the creating process is not among a common set of applications listed as exclusions. Attackers may generate RDP connection files to enable stealthy access or persistence using user interaction. The detection relies on Windows file event telemetry that includes the target filename and the creating process image path.
references:
  - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/
  - https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_rdp_file_susp_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-18
modified: 2024-11-01
tags:
  - attack.stealth
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith: .rdp
    Image|endswith:
      - \brave.exe
      - \CCleaner Browser\Application\CCleanerBrowser.exe
      - \chromium.exe
      - \firefox.exe
      - \Google\Chrome\Application\chrome.exe
      - \iexplore.exe
      - \microsoftedge.exe
      - \msedge.exe
      - \Opera.exe
      - \Vivaldi.exe
      - \Whale.exe
      - \olk.exe
      - \Outlook.exe
      - \RuntimeBroker.exe
      - \Thunderbird.exe
      - \Discord.exe
      - \Keybase.exe
      - \msteams.exe
      - \Slack.exe
      - \teams.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1