Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
51 detections
Filters
Last updated
All Time
Detection languages
27
14
4
2
2
Contributors
9
8
6
5
4
Categories
27
19
13
8
7
Platforms
43
6
5
5
2
Products / Services
13
11
9
6
6
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
IDS Classtypes
2
IDS Protocols
2
This rule detects a high volume of remote desktop session changes (logon/logoff) for a single user within a one-hour window. Event IDs 4778 and 4779 indicate a session reconnected or disconnected, respectively. A high count (>=10) could suggest suspicious activity such as session hijacking, rapid reconnections by an attacker, or automated tools interacting with remote sessions.
This rule detects potential RDP session hijacking attempts originating from an internal host. It specifically looks for TCP traffic destined for port 3389 (RDP) on the home network, with a specific content signature "|03 00|" at the beginning of the payload. A threshold of 3 connections within 10 seconds from the same destination is set to reduce false positives.
Detects attempts to hijack active remote sessions for lateral movement
This rule detects a high volume of remote desktop session changes (logon/logoff) for a single user within a one-hour window. Event IDs 4778 and 4779 indicate a session reconnected or disconnected, respectively. A high count (>=10) could suggest suspicious activity such as session hijacking, rapid reconnections by an attacker, or automated tools interacting with remote sessions.
This rule detects potential RDP session hijacking attempts by looking for the string "tscon" within TCP traffic destined for port 3389 (RDP). The 'tscon' command can be used to connect to or take control of another user's RDP session.
Detects multiple activities associated with the CTRL framework, including hiding user accounts, persistence via scheduled tasks, UAC bypass using wlrmdr.exe, RDP shadow session hijacking, VPN disconnects via rasdial, and RDP restriction loosening.
Detects possible MuddyWater related activity in Microsoft Defender XDR Advanced Hunting by correlating suspicious process, network, file, and logon telemetry into a unified timeline. The hunt focuses on behaviours reported in the Huntress MuddyWater attack chain, including Remote Desktop logons, reconnaissance commands, OpenSSH reverse tunnelling, suspicious network connections, and possible DLL side loading involving FMAPP.exe and FMAPP.dll.
This rule is designed to detect potential RDP session hijacking activity within the environment. RDP session hijacking occurs when an existing Remote Desktop session is taken over or reassigned without initiating a new authentication process.
Monitoring this behavior helps identify suspicious attempts to interact with or assume control of active remote sessions.
Monitoring this behavior helps identify suspicious attempts to interact with or assume control of active remote sessions.
Detects scenarios where an attacker attempts to create a service that triggers TSCON in order to preform local RDP session hijack.
The following analytic detects successful Remote Desktop Protocol (RDP) connections by monitoring EventCode 1149 from the Windows TerminalServices RemoteConnectionManager Operational log. This detection is significant as successful RDP connections can indicate remote access to a system, which may be leveraged by attackers to control or exfiltrate data. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further lateral movement within the network. Monitoring successful RDP connections is crucial for identifying potential security breaches and mitigating risks promptly.
The following analytic detects potential RDP Hijacking attempts by identifying the creation of a Windows service using sc.exe with a binary path that includes tscon.exe. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events and command-line arguments. This activity is significant as it indicates an attacker may be trying to hijack a disconnected RDP session, posing a risk of unauthorized access. If confirmed malicious, the attacker could gain control over an existing user session, leading to potential data theft or further system compromise.
Detects potentially rogue or self-hosted ConnectWise Control (ScreenConnect) session launches based on suspicious query string patterns in the command line. Specifically flags sessions that include parameters like `e=...&y=...&h=...&p=...` but where the `h=` (host) value does not include common trusted TLDs. May indicate use of unauthorized remote access tools.
Investigative Tip: Sandboxing or running the strings command against the binary will reveal the embedded host parameter if you really want to be sure.
Investigative Tip: Sandboxing or running the strings command against the binary will reveal the embedded host parameter if you really want to be sure.
SPL Query
KQL Query from file: Attacker in the Middle Precision Detection
'Identifies when an RDP connection is made to multiple systems and above the normal connection count for the previous 7 days.
Connections from the same system with the same account within the same day.
RDP connections are indicated by the EventID 4624 with LogonType = 10'
Connections from the same system with the same account within the same day.
RDP connections are indicated by the EventID 4624 with LogonType = 10'
Detects RDP session hijacking by using MSTSC shadowing
Detects a suspicious RDP session redirect using tscon.exe
This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services.
It finds all user accounts that have logged on to an endpoint affected by Cobalt Strike, a penetration tool.
Assume that all credentials on endpoints affected by Cobalt Strike were available to attackers and that all associated accounts are compromised. Note that attackers will not only dump credentials for accounts that have logged on to interactive or RDP sessions, but will also dump cached credentials and passwords for service accounts and scheduled tasks that are stored in the LSA Secrets section of the registry.
Reference - https://attack.mitre.org/software/S0154/
It finds all user accounts that have logged on to an endpoint affected by Cobalt Strike, a penetration tool.
Assume that all credentials on endpoints affected by Cobalt Strike were available to attackers and that all associated accounts are compromised. Note that attackers will not only dump credentials for accounts that have logged on to interactive or RDP sessions, but will also dump cached credentials and passwords for service accounts and scheduled tasks that are stored in the LSA Secrets section of the registry.
Reference - https://attack.mitre.org/software/S0154/
Detects a suspicious RDP session redirect using tscon.exe
c2-bluekeep
KQL
This query was originally published in the threat analytics report, Exploitation of CVE-2019-0708 (BlueKeep).
CVE-2019-0708, also known as BlueKeep, is a critical remote code execution vulnerability involving RDP. Soon after its disclosure, the NSA issued a rare advisory about this vulnerability, out of concern that it could be used to quickly spread malware. Attackers have since used this vulnerability to install cryptocurrency miners on targets.
Microsoft has issued updates for this vulnerability, as well as guidance for protecting operating systems that we no longer support. Microsoft Defender ATP also contains behavioral detections for defending against this threat.
The following query locates devices that have communicated with attacker infrastructure associated with BlueKeep-related cryptomining.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0708
https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1865726/nsa-cybersecurity-advisory-patch-remote-desktop-services-on-legacy-versions-of/
https://www.wired.com/story/bluekeep-hacking-cryptocurrency-mining/
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0708
https://support.microsoft.com/help/4500705/customer-guidance-for-cve-2019-0708
https://www.microsoft.com/security/blog/2019/11/07/the-new-cve-2019-0708-rdp-exploit-attacks-explained/
CVE-2019-0708, also known as BlueKeep, is a critical remote code execution vulnerability involving RDP. Soon after its disclosure, the NSA issued a rare advisory about this vulnerability, out of concern that it could be used to quickly spread malware. Attackers have since used this vulnerability to install cryptocurrency miners on targets.
Microsoft has issued updates for this vulnerability, as well as guidance for protecting operating systems that we no longer support. Microsoft Defender ATP also contains behavioral detections for defending against this threat.
The following query locates devices that have communicated with attacker infrastructure associated with BlueKeep-related cryptomining.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0708
https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1865726/nsa-cybersecurity-advisory-patch-remote-desktop-services-on-legacy-versions-of/
https://www.wired.com/story/bluekeep-hacking-cryptocurrency-mining/
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0708
https://support.microsoft.com/help/4500705/customer-guidance-for-cve-2019-0708
https://www.microsoft.com/security/blog/2019/11/07/the-new-cve-2019-0708-rdp-exploit-attacks-explained/
Detects RDP session hijacking by using MSTSC shadowing
Page 2 of 3