SigmaHQ/rules/windows/network_connection/sysmon_rdp_reverse_tunnel.yml

29 lines
741 B
YAML
Executable File

title: RDP Over Reverse SSH Tunnel
id: 5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4
status: experimental
description: Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389
references:
- https://twitter.com/SBousseaden/status/1096148422984384514
author: Samir Bousseaden
date: 2019/02/16
tags:
- attack.defense_evasion
- attack.command_and_control
- attack.t1076
- car.2013-07-002
logsource:
category: network_connection
product: windows
detection:
selection:
Image: '*\svchost.exe'
Initiated: 'true'
SourcePort: 3389
DestinationIp:
- '127.*'
- '::1'
condition: selection
falsepositives:
- unknown
level: high