name: Remote Desktop Process Running On System
id: f5939373-8054-40ad-8c64-cec478a22a4a
version: 5
date: '2020-07-21'
author: David Dorsey, Splunk
type: batch
datamodel:
- Endpoint
description: This search looks for the remote desktop process mstsc.exe running on
  systems upon which it doesn't typically run. This is accomplished by filtering out
  all systems that are noted in the `common_rdp_source category` in the Assets and
  Identity framework.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where Processes.process=*mstsc.exe
  AND Processes.dest_category!=common_rdp_source by Processes.dest Processes.user
  Processes.process | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  | `drop_dm_object_name(Processes)` | `remote_desktop_process_running_on_system_filter` '
how_to_implement: To successfully implement this search, you must be ingesting data
  that records process activity from your hosts to populate the endpoint data model
  in the processes node. The search requires you to identify systems that do not commonly
  use remote desktop. You can use the included support search "Identify Systems Using
  Remote Desktop" to identify these systems. After identifying them, you will need
  to add the "common_rdp_source" category to that system using the Enterprise Security
  Assets and Identities framework. This can be done by adding an entry in the assets.csv
  file located in `SA-IdentityManagement/lookups`.
known_false_positives: Remote Desktop may be used legitimately by users on the network.
references: []
tags:
  analytic_story:
  - Hidden Cobra Malware
  - Lateral Movement
  asset_type: Endpoint
  cis20:
  - CIS 3
  - CIS 9
  - CIS 16
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1021.001
  nist:
  - DE.AE
  - PR.AC
  - PR.IP
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.process
  - Processes.dest_category
  - Processes.dest
  - Processes.user
  security_domain: endpoint
