splunk-security_content/dev/endpoint/remote_desktop_process_running_on_system.yml

name: Remote Desktop Process Running On System
id: f5939373-8054-40ad-8c64-cec478a22a4a
version: 5
date: '2020-07-21'
author: David Dorsey, Splunk
status: experimental
type: Hunting
description: This search looks for the remote desktop process mstsc.exe running on
  systems upon which it doesn't typically run. This is accomplished by filtering out
  all systems that are noted in the `common_rdp_source category` in the Assets and
  Identity framework.
data_source:
- Sysmon Event ID 1
search:
  selection1:
    Processes.dest_category: common_rdp_source
    CommandLine: '*mstsc.exe'
  condition: selection1
how_to_implement: To successfully implement this search, you must be ingesting data
  that records process activity from your hosts to populate the endpoint data model
  in the processes node. The search requires you to identify systems that do not commonly
  use remote desktop. You can use the included support search "Identify Systems Using
  Remote Desktop" to identify these systems. After identifying them, you will need
  to add the "common_rdp_source" category to that system using the Enterprise Security
  Assets and Identities framework. This can be done by adding an entry in the assets.csv
  file located in `SA-IdentityManagement/lookups`.
known_false_positives: Remote Desktop may be used legitimately by users on the network.
references: []
tags:
  analytic_story:
  - Hidden Cobra Malware
  - Active Directory Lateral Movement
  asset_type: Endpoint
  confidence: 50
  impact: 50
  message: tbd
  mitre_attack_id:
  - T1021.001
  - T1021
  observable:
  - name: user
    type: User
    role:
    - Victim
  - name: dest
    type: Hostname
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 25
  security_domain: endpoint