Windows RDP Logon from Localhost IP (127.0.0.1/::1)

title: Windows RDP Logon from Localhost IP (127.0.0.1/::1)
id: 393f5b5f-bcd4-49d8-b714-aea11d1c5fc3
status: test
description: This rule flags Windows Security events where a successful RDP-related logon occurs with a source address of localhost (127.0.0.1 or ::1). Localhost-sourced logons can indicate a tunneled or proxy-like access path that may bypass expected network controls. It relies on Security log event telemetry, specifically EventID 4624 with LogonType 10 and matching IpAddress values.
references:
  - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_rdp_localhost_login.yml
author: Thomas Patzke, Huntrule Team
date: 2019-01-28
modified: 2022-10-09
tags:
  - attack.lateral-movement
  - car.2013-07-002
  - attack.t1021.001
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 10
    IpAddress:
      - ::1
      - 127.0.0.1
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 51e33403-2a37-4d66-a574-1fda1782cc31
    type: derived