Windows Security Event 5156: RDP (3389) over loopback via svchost reverse SSH tunnel

title: "Windows Security Event 5156: RDP (3389) over loopback via svchost reverse SSH tunnel"
id: 88953c90-8810-47a0-a6b3-c7cdeccaaa83
status: test
description: This rule identifies Windows host activity where svchost opens or communicates over the RDP port (3389) using loopback addresses (127.* or ::1). Such behavior can indicate a reverse tunnel or local proxy that lets an attacker route RDP traffic internally while avoiding direct external exposure. It relies on Windows Security auditing (EventID 5156) and uses port and source/destination IP matching plus exclusions for AppContainer Loopback and thor.exe/thor64.exe.
references:
  - https://twitter.com/SBousseaden/status/1096148422984384514
  - https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/44fbe85f72ee91582876b49678f9a26292a155fb/Command%20and%20Control/DE_RDP_Tunnel_5156.evtx
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_rdp_reverse_tunnel.yml
author: Samir Bousseaden, Huntrule Team
date: 2019-02-16
modified: 2022-09-02
tags:
  - attack.command-and-control
  - attack.lateral-movement
  - attack.t1090.001
  - attack.t1090.002
  - attack.t1021.001
  - car.2013-07-002
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5156
  sourceRDP:
    SourcePort: 3389
    DestAddress:
      - 127.*
      - ::1
  destinationRDP:
    DestPort: 3389
    SourceAddress:
      - 127.*
      - ::1
  filter_app_container:
    FilterOrigin: AppContainer Loopback
  filter_thor:
    Application|endswith:
      - \thor.exe
      - \thor64.exe
  condition: selection and ( sourceRDP or destinationRDP ) and not 1 of filter*
falsepositives:
  - Programs that connect locally to the RDP port
level: high
license: DRL-1.1
related:
  - id: 5bed80b6-b3e8-428e-a3ae-d3c757589e41
    type: derived