Windows WFP Event 5156: RDP traffic via loopback when hosted by svchost termsvcs
Flags Windows EventID 5156 where svchost RDP (3389) traffic targets loopback addresses, suggesting tunneled local RDP usage.
- Product
- windows
- Service
- security
- Author
- Samir Bousseaden (SigmaHQ), DRL 1.1
- Published
- 2019-02-16
- Updated
- 2026-07-31
ATT&CK techniques
Lateral Movement → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
Identifies Windows Security audit events (EventID 5156) where RDP port 3389 is used with loopback destinations/sources (127.* or ::1), with activity tied to svchost hosting termsvcs. This pattern can indicate an RDP session being tunneled or proxied locally using a reverse SSH-style loopback flow. The rule relies on Security log telemetry capturing WFP connection details, including ports and loopback IP matching, and filters out AppContainer loopback noise and thor.exe usage.
Reporting behind it
- twitter.comhttps://twitter.com/SBousseaden/status/1096148422984384514
- github.comhttps://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/44fbe85f72ee91582876b49678f9a26292a155fb/Command%20and%20Control/DE_RDP_Tunnel_5156.evtx
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_rdp_reverse_tunnel.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows WFP Event 5156: RDP traffic via loopback when hosted by svchost termsvcs"
id: 88953c90-8810-47a0-a6b3-c7cdeccaaa83
status: test
description: Identifies Windows Security audit events (EventID 5156) where RDP port 3389 is used with loopback destinations/sources (127.* or ::1), with activity tied to svchost hosting termsvcs. This pattern can indicate an RDP session being tunneled or proxied locally using a reverse SSH-style loopback flow. The rule relies on Security log telemetry capturing WFP connection details, including ports and loopback IP matching, and filters out AppContainer loopback noise and thor.exe usage.
references:
- https://twitter.com/SBousseaden/status/1096148422984384514
- https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/44fbe85f72ee91582876b49678f9a26292a155fb/Command%20and%20Control/DE_RDP_Tunnel_5156.evtx
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_rdp_reverse_tunnel.yml
author: Samir Bousseaden, Huntrule Team
date: 2019-02-16
modified: 2022-09-02
tags:
- attack.command-and-control
- attack.lateral-movement
- attack.t1090.001
- attack.t1090.002
- attack.t1021.001
- car.2013-07-002
logsource:
product: windows
service: security
detection:
selection:
EventID: 5156
sourceRDP:
SourcePort: 3389
DestAddress:
- 127.*
- ::1
destinationRDP:
DestPort: 3389
SourceAddress:
- 127.*
- ::1
filter_app_container:
FilterOrigin: AppContainer Loopback
filter_thor:
Application|endswith:
- \thor.exe
- \thor64.exe
condition: selection and ( sourceRDP or destinationRDP ) and not 1 of filter*
falsepositives:
- Programs that connect locally to the RDP port
level: high
license: DRL-1.1
related:
- id: 5bed80b6-b3e8-428e-a3ae-d3c757589e41
type: derived