I AM THE RDP

detections/endpoint/windows_rdp_connection_successful.yml

@@ -0,0 +1,51 @@
+name: Windows RDP Connection Successful
+id: ceaed840-56b3-4a70-b8e1-d762b1c5c08c
+version: 1
+date: '2023-04-17'
+author: Michael Haag, Splunk
+status: production
+type: Hunting
+data_source:
+- 'Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational'
+description: The following analytic identifies successful remote desktop connections. Utilize this analytic to hunt for successful attempts. In addition, the query may be modified for EventCode=1148 to potentially identify failed attempts. In testing, 1148 would not generate based on a failed logon attempt.
+  Note this analytic requires enabling and a stanza in a inputs.conf.
+search: 'index=win source="WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" EventCode=1149
+  | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName, Source_Network_Address, User, Message
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | rename ComputerName as dest | `windows_rdp_connection_successful_filter`'
+how_to_implement: The following analyic requires the WIndows TerminalServices RemoteConnectionManager Operational log to be enabled and ingested into Splunk. For the inputs, review https://gist.github.com/MHaggis/138c6bf563bacbda4a2524f089773706. 
+known_false_positives: False positives will be present, filter as needed or restrict to critical assets on the perimeter.
+references:
+  - https://gist.github.com/MHaggis/138c6bf563bacbda4a2524f089773706
+  - https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  asset_type: Endpoint
+  atomic_guid: []
+  confidence: 50
+  impact: 50
+  message: A successful RDP connection on $dest$ occurred.
+  mitre_attack_id:
+  - T1563.002
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: Source_Network_Address
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 25
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1563.002/rdphijack/remoteconnectionmanager.log
+    source: WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
+    sourcetype: wineventlog