Rule: RDP over Reverse SSH Tunnel

00000SZ · Feb 16, 2019 · f0a4aed · f0a4aed
1 parent 08e0094
commit f0a4aed
Show file tree

Hide file tree

Showing 2 changed files with 57 additions and 0 deletions.
diff --git a/rules/windows/builtin/win_rdp_reverse_tunnel.yml b/rules/windows/builtin/win_rdp_reverse_tunnel.yml
@@ -0,0 +1,31 @@
+title: RDP over Reverse SSH Tunnel WFP
+status: experimental
+description: Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389
+references:
+    - https://twitter.com/SBousseaden/status/1096148422984384514
+author: Samir Bousseaden
+date: 2019/02/16
+tags:
+    - attack.defense_evasion
+    - attack.command_and_control
+    - attack.t1076
+logsource:
+    product: windows
+    service: security
+detection:
+    selection:
+        EventID: 5156
+    sourceRDP:
+        SourcePort: 3389
+        DestinationAddress:
+            - '127.*'
+            - '::1'
+    destinationRDP:
+        DestinationPort: 3389
+        SourceAddress:
+            - '127.*'
+            - '::1'
+    condition: selection and ( sourceRDP or destinationRDP )
+falsepositives:
+    - unknown
+level: high
diff --git a/rules/windows/sysmon/sysmon_rdp_reverse_tunnel.yml b/rules/windows/sysmon/sysmon_rdp_reverse_tunnel.yml
@@ -0,0 +1,26 @@
+title: RDP over Reverse SSH Tunnel
+status: experimental
+description: Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389
+references:
+    - https://twitter.com/SBousseaden/status/1096148422984384514
+author: Samir Bousseaden
+date: 2019/02/16
+tags:
+    - attack.defense_evasion
+    - attack.command_and_control
+    - attack.t1076
+logsource:
+    product: windows
+    service: sysmon
+detection:
+    selection:
+        EventID: 3
+        Image: '*\svchost.exe'
+        SourcePort: 3389 
+        DestinationIp:
+            - '127.*'
+            - '::1'
+    condition: selection
+falsepositives:
+    - unknown
+level: high