From 8f8a6bd3b4ece7ba98065d279136212dcf9d7080 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 25 Nov 2024 11:44:23 -0700 Subject: [PATCH 1/8] Raiders of the Lost RDP: The Haag Crusade --- ...indows_terminalservices_rdpclient_1024.yml | 61 ++++++++++++ .../endpoint/windows_rdp_file_execution.yml | 96 +++++++++++++++++++ ...s_rdpclient_connection_sequence_events.yml | 61 ++++++++++++ macros/wineventlog_rdp.yml | 4 + 4 files changed, 222 insertions(+) create mode 100644 data_sources/windows_event_log_microsoft_windows_terminalservices_rdpclient_1024.yml create mode 100644 detections/endpoint/windows_rdp_file_execution.yml create mode 100644 detections/endpoint/windows_rdpclient_connection_sequence_events.yml create mode 100644 macros/wineventlog_rdp.yml diff --git a/data_sources/windows_event_log_microsoft_windows_terminalservices_rdpclient_1024.yml b/data_sources/windows_event_log_microsoft_windows_terminalservices_rdpclient_1024.yml new file mode 100644 index 0000000000..d17981dc1f --- /dev/null +++ b/data_sources/windows_event_log_microsoft_windows_terminalservices_rdpclient_1024.yml @@ -0,0 +1,61 @@ +name: Windows Event Log Microsoft Windows TerminalServices RDPClient 1024 +id: 2490537e-5e0c-46f7-9209-f56f852aa217 +version: 1 +date: '2024-11-21' +author: Michael Haag, Splunk +description: Data source object for Windows Event Microsoft Windows TerminalServices RDPClient 1024 +source: WinEventLog:Microsoft-Windows-TerminalServices-RDPClient/Operational +sourcetype: WinEventLog +separator: EventCode +supported_TA: [] +fields: +- _time +- Channel +- Computer +- EventCode +- EventData +- EventID +- EventRecordID +- EventType +- Keywords +- Level +- Message +- Opcode +- ProcessID +- RecordNumber +- Security_ID +- Src +- Src_Host +- Src_NT_Domain +- Src_User +- System_TimeCreated +- Task +- ThreadID +- Type +- User +- UserID +- Version +- dest +- dvc +- event_id +- host +- source +- sourcetype +- tag +- user +example_log: + 11/21/2024 06:09:16 PM + LogName=Microsoft-Windows-TerminalServices-RDPClient/Operational + EventCode=1024 + EventType=4 + ComputerName=ar-win-5.attackrange.local + User=NOT_TRANSLATED + Sid=S-1-5-21-1731938146-2314223186-1848411941-500 + SidType=0 + SourceName=Microsoft-Windows-TerminalServices-ClientActiveXCore + Type=Information + RecordNumber=95 + Keywords=None + TaskCategory=Connection Sequence + OpCode=This event is raised during the connection process + Message=RDP ClientActiveX is trying to connect to the server (34.221.50.57) \ No newline at end of file diff --git a/detections/endpoint/windows_rdp_file_execution.yml b/detections/endpoint/windows_rdp_file_execution.yml new file mode 100644 index 0000000000..59b5bf8e73 --- /dev/null +++ b/detections/endpoint/windows_rdp_file_execution.yml @@ -0,0 +1,96 @@ +data_source: [] +name: Windows RDP File Execution +id: 0b6b12b9-8ba9-48fe-b3b8-b4e3e1cd22b4 +version: 1 +date: '2024-11-21' +author: Michael Haag, Splunk +type: TTP +status: production +description: The following analytic detects when a Windows RDP client attempts to execute an RDP file from a temporary directory, downloads directory, or Outlook directories. This detection is significant as it can indicate an attempt for an adversary to delivery a .rdp file, which may be leveraged by attackers to control or exfiltrate data. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further lateral movement within the network. +search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process IN ("*\\AppData\\Local\\Temp\\*", "*\\AppData\\Local\\Microsoft\\Outlook\\*", "*\\Content.Outlook\\*", "*\\Downloads\\*") + AND Processes.process="*.rdp*" + by Processes.process Processes.process_name Processes.user Processes.dest Processes.parent_process_name Processes.parent_process + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | eval + execution_type=case( + match(process, "\\\\Temp\\\\.*\\.(zip|7z|rar|gz|tar|iso|img|vhd|vhdx).*\\.*\\.rdp"), "temp_archive_execution", + match(process, "\\\\Downloads\\\\"), "downloads_execution", + match(process, "\\\\Temp\\\\"), "temp_execution", + match(process, "\\\\Microsoft\\\\Outlook\\\\"), "outlook_execution", + match(process, "\\\\Content.Outlook\\\\"), "outlook_execution", + true(), "other" + ), + risk_score=case( + execution_type="temp_archive_execution", "Critical", + execution_type IN ("temp_execution", "outlook_execution"), "High", + execution_type="downloads_execution", "Medium", + true(), "Low" + ), + risk_reason=case( + execution_type="temp_archive_execution", "RDP file executed directly from archive/disk image in Temp directory", + execution_type="downloads_execution", "RDP file executed from Downloads directory (Could be legitimate admin activity)", + execution_type="temp_execution", "RDP file executed from Temp directory", + execution_type="outlook_execution", "RDP file executed from Outlook directories", + true(), "Standard RDP file execution" + ) + | sort - risk_score + | rename + process_name as "RDP Process", + parent_process_name as "Parent Process", + process as "Command Line", + user as "User", + execution_type as "Execution Context", + risk_score as "Risk Level", + risk_reason as "Risk Details" + | fields - parent_process | `windows_rdp_file_execution_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: False positives may be present based on administrators using RDP files for legitimate purposes. Filter as needed. +references: +- https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +tags: + analytic_story: + - Spearphishing Attachments + asset_type: Endpoint + confidence: 70 + impact: 60 + message: A Windows RDP client attempted to execute an RDP file from a temporary directory, downloads directory, or Outlook directories on the endpoint $dest$. + mitre_attack_id: + - T1598.002 + - T1021.001 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - process_guid + - process_name + - process + - parent_process_name + - parent_process + - user + risk_score: 42 + security_domain: endpoint + cve: [] +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1598.002/rdp/windows-sysmon.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational \ No newline at end of file diff --git a/detections/endpoint/windows_rdpclient_connection_sequence_events.yml b/detections/endpoint/windows_rdpclient_connection_sequence_events.yml new file mode 100644 index 0000000000..ecfe299ced --- /dev/null +++ b/detections/endpoint/windows_rdpclient_connection_sequence_events.yml @@ -0,0 +1,61 @@ +data_source: +- Windows Event Log Microsoft Windows TerminalServices RDPClient 1024 +name: Windows RDPClient Connection Sequence Events +id: 67340df1-3f1d-4470-93c8-9ac7249d11b0 +version: 1 +date: '2024-11-21' +author: Michael Haag, Splunk +type: Anomaly +status: production +description: This analytic monitors Windows RDP client connection sequence events (EventCode 1024) from the Microsoft-Windows-TerminalServices-RDPClient/Operational log. These events track when RDP ClientActiveX initiates connection attempts to remote servers. The connection sequence is a critical phase of RDP where the client and server exchange settings and establish common parameters for the session. Monitoring these events can help identify unusual RDP connection patterns, potential lateral movement attempts, unauthorized remote access activity, and RDP connection chains that may indicate compromised systems. NOTE the analytic was written for Multi-Line as XML was not properly parsed out. +search: '`wineventlog_rdp` EventCode=1024 + | rename host as dest + | stats count as "Event Count", min(_time) as firstTime, max(_time) as lastTime, values(Message) as messages by dest, source, LogName, EventCode, category + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rdpclient_connection_sequence_events_filter`' +how_to_implement: To successfully implement this detection, ensure Windows RDP Client Operational logs are being collected and forwarded to Splunk. Enable logging for "Microsoft-Windows-TerminalServices-RDPClient/Operational", via a new inputs.conf input. See references for more details. +known_false_positives: Legitimate RDP connections from authorized administrators and users will generate these events. To reduce false positives, you should baseline normal RDP connection patterns in your environment, whitelist expected RDP connection chains between known administrative workstations and servers, and track authorized remote support sessions. +references: +- https://gist.github.com/MHaggis/acd5dcbf1d4fb705b77f0a48e772eefc +- https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +tags: + analytic_story: + - Spearphishing Attachments + asset_type: Endpoint + confidence: 70 + impact: 10 + message: A Windows RDP client initiated a connection sequence event (EventCode 1024) on host $dest$. + mitre_attack_id: + - T1133 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - host + - source + - LogName + - EventCode + - category + risk_score: 7 + security_domain: endpoint + cve: [] +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1133/rdp/terminalservices-rdpclient.log + sourcetype: WinEventLog + source: WinEventLog:Microsoft-Windows-TerminalServices-RDPClient/Operational diff --git a/macros/wineventlog_rdp.yml b/macros/wineventlog_rdp.yml new file mode 100644 index 0000000000..63194303de --- /dev/null +++ b/macros/wineventlog_rdp.yml @@ -0,0 +1,4 @@ +definition: source="WinEventLog:Microsoft-Windows-TerminalServices-RDPClient/Operational" +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: wineventlog_rdp From 810a520721fb6d01d39f58ff7b6d3a13576a106c Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 25 Nov 2024 12:05:41 -0700 Subject: [PATCH 2/8] Update windows_rdp_file_execution.yml --- detections/endpoint/windows_rdp_file_execution.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_rdp_file_execution.yml b/detections/endpoint/windows_rdp_file_execution.yml index 59b5bf8e73..e93042ce9d 100644 --- a/detections/endpoint/windows_rdp_file_execution.yml +++ b/detections/endpoint/windows_rdp_file_execution.yml @@ -91,6 +91,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1598.002/rdp/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1598.002/rdp/mstsc_rdpfile-windows-sysmon.log sourcetype: XmlWinEventLog source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational \ No newline at end of file From d80e5db350584a7fdb254d1754ca10efb67eff29 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 25 Nov 2024 12:07:39 -0700 Subject: [PATCH 3/8] Update windows_rdp_file_execution.yml --- detections/endpoint/windows_rdp_file_execution.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_rdp_file_execution.yml b/detections/endpoint/windows_rdp_file_execution.yml index e93042ce9d..228753ed2f 100644 --- a/detections/endpoint/windows_rdp_file_execution.yml +++ b/detections/endpoint/windows_rdp_file_execution.yml @@ -91,6 +91,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1598.002/rdp/mstsc_rdpfile-windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1598.002/rdp/mstsc_rdpfile-windows-sysmon.log sourcetype: XmlWinEventLog source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational \ No newline at end of file From 3acd1f949abf805db1439e734c63e3d4e9d3fd06 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 25 Nov 2024 15:47:44 -0700 Subject: [PATCH 4/8] Update detections/endpoint/windows_rdp_file_execution.yml Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com> --- detections/endpoint/windows_rdp_file_execution.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_rdp_file_execution.yml b/detections/endpoint/windows_rdp_file_execution.yml index 228753ed2f..1328da7c12 100644 --- a/detections/endpoint/windows_rdp_file_execution.yml +++ b/detections/endpoint/windows_rdp_file_execution.yml @@ -16,7 +16,7 @@ search: '| tstats count min(_time) as firstTime max(_time) as lastTime from data | `security_content_ctime(lastTime)` | eval execution_type=case( - match(process, "\\\\Temp\\\\.*\\.(zip|7z|rar|gz|tar|iso|img|vhd|vhdx).*\\.*\\.rdp"), "temp_archive_execution", + match(process, "\\\\Temp\\\\.*\\.(zip|7z|rar|cab|tgz|gz|tar|iso|img|vhd|vhdx).*\\.*\\.rdp"), "temp_archive_execution", match(process, "\\\\Downloads\\\\"), "downloads_execution", match(process, "\\\\Temp\\\\"), "temp_execution", match(process, "\\\\Microsoft\\\\Outlook\\\\"), "outlook_execution", From 9084ddcff4681f264528dd50cadd437caf345dce Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 25 Nov 2024 15:47:53 -0700 Subject: [PATCH 5/8] Update detections/endpoint/windows_rdp_file_execution.yml Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com> --- detections/endpoint/windows_rdp_file_execution.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_rdp_file_execution.yml b/detections/endpoint/windows_rdp_file_execution.yml index 1328da7c12..f3f7d8d007 100644 --- a/detections/endpoint/windows_rdp_file_execution.yml +++ b/detections/endpoint/windows_rdp_file_execution.yml @@ -8,7 +8,7 @@ type: TTP status: production description: The following analytic detects when a Windows RDP client attempts to execute an RDP file from a temporary directory, downloads directory, or Outlook directories. This detection is significant as it can indicate an attempt for an adversary to delivery a .rdp file, which may be leveraged by attackers to control or exfiltrate data. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further lateral movement within the network. search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process IN ("*\\AppData\\Local\\Temp\\*", "*\\AppData\\Local\\Microsoft\\Outlook\\*", "*\\Content.Outlook\\*", "*\\Downloads\\*") + where Processes.process IN ("*\\AppData\\Local\\Temp\\*", "*\\Olk\\Attachments\\*", "*\\AppData\\Local\\Microsoft\\Outlook\\*", "*\\Content.Outlook\\*", "*\\Downloads\\*") AND Processes.process="*.rdp*" by Processes.process Processes.process_name Processes.user Processes.dest Processes.parent_process_name Processes.parent_process | `drop_dm_object_name(Processes)` From 245bd2ac030c16bb496cabe20e670263c7f46757 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 25 Nov 2024 15:48:05 -0700 Subject: [PATCH 6/8] Update detections/endpoint/windows_rdp_file_execution.yml Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com> --- detections/endpoint/windows_rdp_file_execution.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/windows_rdp_file_execution.yml b/detections/endpoint/windows_rdp_file_execution.yml index f3f7d8d007..acc2b0720b 100644 --- a/detections/endpoint/windows_rdp_file_execution.yml +++ b/detections/endpoint/windows_rdp_file_execution.yml @@ -20,6 +20,7 @@ search: '| tstats count min(_time) as firstTime max(_time) as lastTime from data match(process, "\\\\Downloads\\\\"), "downloads_execution", match(process, "\\\\Temp\\\\"), "temp_execution", match(process, "\\\\Microsoft\\\\Outlook\\\\"), "outlook_execution", + match(process, "\\\\Olk\\\\Attachments\\\\"), "outlook_execution", match(process, "\\\\Content.Outlook\\\\"), "outlook_execution", true(), "other" ), From 34a60ce3cf9b1efc4c13618530407b83685a07c5 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 26 Nov 2024 06:55:19 -0700 Subject: [PATCH 7/8] Update windows_rdp_file_execution.yml --- detections/endpoint/windows_rdp_file_execution.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_rdp_file_execution.yml b/detections/endpoint/windows_rdp_file_execution.yml index acc2b0720b..47319de555 100644 --- a/detections/endpoint/windows_rdp_file_execution.yml +++ b/detections/endpoint/windows_rdp_file_execution.yml @@ -1,4 +1,7 @@ -data_source: [] +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 name: Windows RDP File Execution id: 0b6b12b9-8ba9-48fe-b3b8-b4e3e1cd22b4 version: 1 @@ -94,4 +97,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1598.002/rdp/mstsc_rdpfile-windows-sysmon.log sourcetype: XmlWinEventLog - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational \ No newline at end of file + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational From 5276854ae8b54cf90e60877657a5dc0d3f38aeb6 Mon Sep 17 00:00:00 2001 From: pyth0n1c Date: Mon, 2 Dec 2024 13:52:40 -0800 Subject: [PATCH 8/8] Move data_source to middle of yml. Fix minor typos or still present in drilldown. --- detections/endpoint/windows_rdp_file_execution.yml | 10 +++++----- .../windows_rdpclient_connection_sequence_events.yml | 6 +++--- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/windows_rdp_file_execution.yml b/detections/endpoint/windows_rdp_file_execution.yml index 47319de555..7bb3814b57 100644 --- a/detections/endpoint/windows_rdp_file_execution.yml +++ b/detections/endpoint/windows_rdp_file_execution.yml @@ -1,7 +1,3 @@ -data_source: - - Sysmon EventID 1 - - Windows Event Log Security 4688 - - CrowdStrike ProcessRollup2 name: Windows RDP File Execution id: 0b6b12b9-8ba9-48fe-b3b8-b4e3e1cd22b4 version: 1 @@ -9,7 +5,11 @@ date: '2024-11-21' author: Michael Haag, Splunk type: TTP status: production -description: The following analytic detects when a Windows RDP client attempts to execute an RDP file from a temporary directory, downloads directory, or Outlook directories. This detection is significant as it can indicate an attempt for an adversary to delivery a .rdp file, which may be leveraged by attackers to control or exfiltrate data. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further lateral movement within the network. +description: The following analytic detects when a Windows RDP client attempts to execute an RDP file from a temporary directory, downloads directory, or Outlook directories. This detection is significant as it can indicate an attempt for an adversary to deliver a .rdp file, which may be leveraged by attackers to control or exfiltrate data. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further lateral movement within the network. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*\\AppData\\Local\\Temp\\*", "*\\Olk\\Attachments\\*", "*\\AppData\\Local\\Microsoft\\Outlook\\*", "*\\Content.Outlook\\*", "*\\Downloads\\*") AND Processes.process="*.rdp*" diff --git a/detections/endpoint/windows_rdpclient_connection_sequence_events.yml b/detections/endpoint/windows_rdpclient_connection_sequence_events.yml index ecfe299ced..df60b1340f 100644 --- a/detections/endpoint/windows_rdpclient_connection_sequence_events.yml +++ b/detections/endpoint/windows_rdpclient_connection_sequence_events.yml @@ -1,5 +1,3 @@ -data_source: -- Windows Event Log Microsoft Windows TerminalServices RDPClient 1024 name: Windows RDPClient Connection Sequence Events id: 67340df1-3f1d-4470-93c8-9ac7249d11b0 version: 1 @@ -8,6 +6,8 @@ author: Michael Haag, Splunk type: Anomaly status: production description: This analytic monitors Windows RDP client connection sequence events (EventCode 1024) from the Microsoft-Windows-TerminalServices-RDPClient/Operational log. These events track when RDP ClientActiveX initiates connection attempts to remote servers. The connection sequence is a critical phase of RDP where the client and server exchange settings and establish common parameters for the session. Monitoring these events can help identify unusual RDP connection patterns, potential lateral movement attempts, unauthorized remote access activity, and RDP connection chains that may indicate compromised systems. NOTE the analytic was written for Multi-Line as XML was not properly parsed out. +data_source: +- Windows Event Log Microsoft Windows TerminalServices RDPClient 1024 search: '`wineventlog_rdp` EventCode=1024 | rename host as dest | stats count as "Event Count", min(_time) as firstTime, max(_time) as lastTime, values(Message) as messages by dest, source, LogName, EventCode, category @@ -23,7 +23,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: