SigmaHQ/rules/windows/sysmon/sysmon_rdp_reverse_tunnel.yml
2020-06-16 14:46:08 -06:00

31 lines
766 B
YAML

title: RDP Over Reverse SSH Tunnel
id: 5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4
status: experimental
description: Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389
references:
- https://twitter.com/SBousseaden/status/1096148422984384514
author: Samir Bousseaden
date: 2019/02/16
tags:
- attack.defense_evasion
- attack.command_and_control
- attack.t1076
- car.2013-07-002
- attack.t1021
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 3
Image: '*\svchost.exe'
Initiated: 'true'
SourcePort: 3389
DestinationIp:
- '127.*'
- '::1'
condition: selection
falsepositives:
- unknown
level: high