mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
47 lines
2.2 KiB
YAML
47 lines
2.2 KiB
YAML
name: Remote Desktop Network Traffic
|
|
id: 272b8407-842d-4b3d-bead-a704584003d3
|
|
version: 3
|
|
date: '2020-07-07'
|
|
description: This search looks for network traffic on TCP/3389, the default port used
|
|
by remote desktop. While remote desktop traffic is not uncommon on a network, it
|
|
is usually associated with known hosts. This search allows for whitelisting both
|
|
source and destination hosts to remove them from the output of the search so you
|
|
can focus on the uncommon uses of remote desktop on your network.
|
|
how_to_implement: To successfully implement this search you need to identify systems
|
|
that commonly originate remote desktop traffic and that commonly receive remote
|
|
desktop traffic. You can use the included support search "Identify Systems Creating
|
|
Remote Desktop Traffic" to identify systems that originate the traffic and the search
|
|
"Identify Systems Receiving Remote Desktop Traffic" to identify systems that receive
|
|
a lot of remote desktop traffic. After identifying these systems, you will need
|
|
to add the "common_rdp_source" or "common_rdp_destination" category to that system
|
|
depending on the usage, using the Enterprise Security Assets and Identities framework. This
|
|
can be done by adding an entry in the assets.csv file located in SA-IdentityManagement/lookups.
|
|
type: ESCU
|
|
references: []
|
|
author: David Dorsey, Splunk
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
|
as lastTime from datamodel=Network_Traffic where All_Traffic.dest_port=3389 AND
|
|
All_Traffic.dest_category!=common_rdp_destination AND All_Traffic.src_category!=common_rdp_source
|
|
by All_Traffic.src All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name("All_Traffic")`
|
|
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_desktop_network_traffic_filter` '
|
|
known_false_positives: Remote Desktop may be used legitimately by users on the network.
|
|
tags:
|
|
analytics_story:
|
|
- SamSam Ransomware
|
|
- Hidden Cobra Malware
|
|
- Lateral Movement
|
|
mitre_attack_id:
|
|
- T1021.001
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
cis20:
|
|
- CIS 3
|
|
- CIS 9
|
|
- CIS 16
|
|
nist:
|
|
- DE.AE
|
|
- PR.AC
|
|
- PR.IP
|
|
security_domain: network
|
|
asset_type: Endpoint
|