Windows svchost RDP via Reverse SSH Loopback Tunnel to 127.0.0.0/8:3389
Flags svchost.exe opening RDP (TCP 3389) connections to loopback, consistent with tunneled reverse access behavior.
- Product
- windows
- Category
- network_connection
- Author
- Samir Bousseaden (SigmaHQ), DRL 1.1
- Published
- 2019-02-16
- Updated
- 2026-07-31
ATT&CK techniques
Lateral Movement → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies Windows network connections where svchost.exe initiates traffic from TCP port 3389 to a loopback destination (127.0.0.0/8 and ::1). Loopback-only RDP traffic can indicate that an attacker is relaying RDP through a local tunnel to evade direct remote exposure and complicate monitoring. Detection relies on network connection telemetry including process image path, connection initiation state, source port, and destination IP.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows svchost RDP via Reverse SSH Loopback Tunnel to 127.0.0.0/8:3389
id: e5dd0417-3f1f-4ef8-b9de-ad58fe8d82c7
status: test
description: This rule identifies Windows network connections where svchost.exe initiates traffic from TCP port 3389 to a loopback destination (127.0.0.0/8 and ::1). Loopback-only RDP traffic can indicate that an attacker is relaying RDP through a local tunnel to evade direct remote exposure and complicate monitoring. Detection relies on network connection telemetry including process image path, connection initiation state, source port, and destination IP.
references:
- https://twitter.com/cyb3rops/status/1096842275437625346
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_rdp_reverse_tunnel.yml
author: Samir Bousseaden, Huntrule Team
date: 2019-02-16
modified: 2024-03-12
tags:
- attack.command-and-control
- attack.t1572
- attack.lateral-movement
- attack.t1021.001
- car.2013-07-002
logsource:
category: network_connection
product: windows
detection:
selection_img:
Image|endswith: \svchost.exe
Initiated: "true"
SourcePort: 3389
selection_destination:
DestinationIp|cidr:
- 127.0.0.0/8
- ::1/128
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4
type: derived