Windows RDP Tunneling Using plink.exe on Local Port 3389

title: Windows RDP Tunneling Using plink.exe on Local Port 3389
id: bed4d332-b5f7-4033-9d6d-d94f918743ba
related:
  - id: f7d7ebd5-a016-46e2-9c54-f9932f2d386d
    type: similar
  - id: f38ce0b9-5e97-4b47-a211-7dc8d8b871da
    type: derived
status: test
description: This rule flags process creation where plink.exe is invoked with command-line arguments indicating an RDP-related local port connection to 127.0.0.1:3389 or a generic 3389 usage. Attackers can use plink to create stealthy network tunneling paths that blend into legitimate tooling and bypass simpler egress or access controls. Telemetry required is Windows process creation events capturing the full image path and command line for plink.exe.
references:
  - https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_plink_susp_tunneling.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-04
modified: 2023-01-27
tags:
  - attack.command-and-control
  - attack.t1572
logsource:
  category: process_creation
  product: windows
detection:
  selection_a:
    Image|endswith: \plink.exe
    CommandLine|contains: :127.0.0.1:3389
  selection_b1:
    Image|endswith: \plink.exe
    CommandLine|contains: :3389
  selection_b2:
    CommandLine|contains:
      - " -P 443"
      - " -P 22"
  condition: selection_a or all of selection_b*
falsepositives:
  - Unknown
level: high
license: DRL-1.1