Zeek RDP Connections From Non-Routable/Public IP Ranges

Alert on Zeek-observed RDP connections originating from non-excluded IP ranges, suggesting external accessibility.

FreeUnreviewedSigmahighv1

zeek-rdp-connections-from-non-routable-public-ip-ranges-1fc0809e

title: Zeek RDP Connections From Non-Routable/Public IP Ranges
id: 645e021e-1ecb-4b15-ae47-8b845192d8d8
status: test
description: This rule flags Zeek RDP traffic where the origin IP is not part of the specified private, loopback, link-local, or other excluded ranges, indicating an RDP listener that is reachable from routable sources. Exposed RDP services are frequently targeted for credential theft and remote access attempts. The detection relies on Zeek RDP logs capturing the connection origin IP (id.orig_h) and applying CIDR-based inclusion/exclusion logic.
author: Josh Brower @DefensiveDepth, Huntrule Team
date: 2020-08-22
modified: 2024-03-13
tags:
  - attack.lateral-movement
  - attack.t1021.001
logsource:
  product: zeek
  service: rdp
detection:
  selection:
    id.orig_h|cidr:
      - ::1/128
      - 10.0.0.0/8
      - 127.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - 2620:83:8000::/48
      - fc00::/7
      - fe80::/10
  condition: not selection
falsepositives:
  - Although it is recommended to NOT have RDP exposed to the internet, verify that this is a) allowed b) the server has not already been compromised via some brute force or remote exploit since it has been exposed to the internet. Work to secure the server if you are unable to remove it from being exposed to the internet.
level: high
license: DRL-1.1
related:
  - id: 1fc0809e-06bf-4de3-ad52-25e5263b7623
    type: derived
references:
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_rdp_public_listener.yml

What it detects

This rule flags Zeek RDP traffic where the origin IP is not part of the specified private, loopback, link-local, or other excluded ranges, indicating an RDP listener that is reachable from routable sources. Exposed RDP services are frequently targeted for credential theft and remote access attempts. The detection relies on Zeek RDP logs capturing the connection origin IP (id.orig_h) and applying CIDR-based inclusion/exclusion logic.

Known false positives

Although it is recommended to NOT have RDP exposed to the internet, verify that this is a) allowed b) the server has not already been compromised via some brute force or remote exploit since it has been exposed to the internet. Work to secure the server if you are unable to remove it from being exposed to the internet.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.