Windows RDP successful logon from public IP (Event ID 4624 LogonType 10)

title: Windows RDP successful logon from public IP (Event ID 4624 LogonType 10)
id: 6d32234d-16fc-40fb-899b-7a71bb668dd1
related:
  - id: 78d5cab4-557e-454f-9fb9-a222bd0d5edc
    type: derived
  - id: 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2
    type: derived
status: test
description: This rule flags Windows Security Event ID 4624 sign-in activity with LogonType 10 where the source IP is not local/private ranges and is not empty. Attackers can use externally reachable RDP to gain initial access or persistence, so successful interactive RDP sessions from public addresses are high-signal. Telemetry relies on Windows Security logs capturing the 4624 event and the recorded IpAddress and LogonType fields.
references:
  - https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html
  - https://twitter.com/Purp1eW0lf/status/1616144561965002752
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_successful_external_remote_rdp_login.yml
author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity), Huntrule Team
date: 2023-01-19
modified: 2024-03-11
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.credential-access
  - attack.stealth
  - attack.t1133
  - attack.t1078
  - attack.t1110
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 10
  filter_main_local_ranges:
    IpAddress|cidr:
      - ::1/128
      - 10.0.0.0/8
      - 127.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - fc00::/7
      - fe80::/10
  filter_main_empty:
    IpAddress: "-"
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate or intentional inbound connections from public IP addresses on the RDP port.
level: medium
license: DRL-1.1