valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #863 from qwerty1q2w/feature

Browse Source 
add win_not_allowed_rdp_access.yml rule
This commit is contained in:
Florian Roth 2020-06-30 10:03:11 +02:00 committed by GitHub
commit ba682c5de6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
rules/windows/builtin/win_not_allowed_rdp_access.yml Normal file
View File

@ -0,0 +1,26 @@
title: Denied Access To Remote Desktop
id: 8e5c03fa-b7f0-11ea-b242-07e0576828d9
description: This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop.
Often, this event can be generated by attackers when searching for available windows servers in the network.
status: experimental
tags:
- attack.lateral_movement
- attack.t1076
references:
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4825
author: Pushkarev Dmitry
date: 2020/06/27
logsource:
product: windows
service: security
detection:
selection:
EventID: 4825
condition: selection
fields:
- EventCode
- AccountName
- ClientAddress
falsepositives:
- Valid user was not added to RDP group
level: medium