Windows svchost.exe RDP (3389) Connections to HTTP/HTTPS Ports 80 or 443
Alerts when svchost.exe initiates from TCP 3389 to destination ports 80 or 443, consistent with possible RDP tunneling over web ports.
- Product
- windows
- Category
- network_connection
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-04-29
- Updated
- 2026-07-31
ATT&CK techniques
Lateral Movement → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
Identifies network connections where svchost.exe initiates traffic from source port 3389 (RDP) to destination ports 80 or 443. This matters because RDP-related services can be used to route or tunnel communications through web-facing ports to evade network controls. The rule relies on Windows network connection telemetry that includes process image path and source/destination port details.
Reporting behind it
- twitter.comhttps://twitter.com/tekdefense/status/1519711183162556416?s=12&t=OTsHCBkQOTNs1k3USz65Zg
- mandiant.comhttps://www.mandiant.com/resources/bypassing-network-restrictions-through-rdp-tunneling
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_rdp_to_http.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows svchost.exe RDP (3389) Connections to HTTP/HTTPS Ports 80 or 443
id: 94a1e9e4-8324-42be-aff5-804fe995010a
status: test
description: Identifies network connections where svchost.exe initiates traffic from source port 3389 (RDP) to destination ports 80 or 443. This matters because RDP-related services can be used to route or tunnel communications through web-facing ports to evade network controls. The rule relies on Windows network connection telemetry that includes process image path and source/destination port details.
references:
- https://twitter.com/tekdefense/status/1519711183162556416?s=12&t=OTsHCBkQOTNs1k3USz65Zg
- https://www.mandiant.com/resources/bypassing-network-restrictions-through-rdp-tunneling
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_rdp_to_http.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-29
modified: 2022-07-14
tags:
- attack.command-and-control
- attack.t1572
- attack.lateral-movement
- attack.t1021.001
- car.2013-07-002
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: \svchost.exe
Initiated: "true"
SourcePort: 3389
DestinationPort:
- 80
- 443
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: b1e5da3b-ca8e-4adf-915c-9921f3d85481
type: derived