Windows svchost RDP Using Reverse SSH Tunnel to Loopback (TCP 3389)

title: Windows svchost RDP Using Reverse SSH Tunnel to Loopback (TCP 3389)
id: e5dd0417-3f1f-4ef8-b9de-ad58fe8d82c7
status: test
description: This rule identifies Windows svchost.exe initiating a network connection with a source port of 3389 to the local loopback address (127.0.0.0/8 or ::1). It matters because local-port RDP traffic is commonly used to route remote access through a tunnel, potentially bypassing standard network visibility and enabling lateral movement. Telemetry relied upon includes network connection events with process image path, initiation status, source port, and destination IP.
references:
  - https://twitter.com/cyb3rops/status/1096842275437625346
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_rdp_reverse_tunnel.yml
author: Samir Bousseaden, Huntrule Team
date: 2019-02-16
modified: 2024-03-12
tags:
  - attack.command-and-control
  - attack.t1572
  - attack.lateral-movement
  - attack.t1021.001
  - car.2013-07-002
logsource:
  category: network_connection
  product: windows
detection:
  selection_img:
    Image|endswith: \svchost.exe
    Initiated: "true"
    SourcePort: 3389
  selection_destination:
    DestinationIp|cidr:
      - 127.0.0.0/8
      - ::1/128
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4
    type: derived