From affae55ecf1776c012eb251de080ff7abcd0fdf1 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 26 May 2021 15:07:28 +0000 Subject: [PATCH] Added detection testing service results inEnable RDP In Other Port Number --- .../enable_rdp_in_other_port_number.yml | 21 +++++++++++-------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index e38a959e7e..eaf7807ce6 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -6,16 +6,16 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a modification to registry to enable rdp to a machine with different port number. - This technique was seen in some atttacker tries to do lateral movement and remote access to a compromised machine to gain control of it. +description: This search is to detect a modification to registry to enable rdp to + a machine with different port number. This technique was seen in some atttacker + tries to do lateral movement and remote access to a compromised machine to gain + control of it. search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) - as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp*" - Registry.registry_key_name = "PortNumber" by Registry.dest Registry.user Registry.registry_value_name - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` - | `enable_rdp_in_other_port_number_filter`' + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal + Server\\WinStations\\RDP-Tcp*" Registry.registry_key_name = "PortNumber" by Registry.dest + Registry.user Registry.registry_value_name | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `enable_rdp_in_other_port_number_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -40,4 +40,7 @@ tags: - Registry.dest - Registry.user - Registry.registry_value_name - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log