Situational AwarenessTTPCAR-2013-07-002

RDP Connection Detection

Hypothesis and description

The Remote Desktop Protocol (RDP), built in to Microsoft operating systems, allows a user to remotely log in to the desktop of another host. It allows for interactive access of the running windows, and forwards key presses, mouse clicks, etc. Network administrators, power users, and end-users may use RDP for day-to-day operations. From an adversary's perspective, RDP provides a means to laterally move to a new host. Determining which RDP connections correspond to adversary activity can be a difficult problem in highly dynamic environments, but will be useful in identifying the scope of a compromise.

Remote Desktop can be detected in several ways

- Network connections to port 3389/tcp (assuming use of the default port)

- Packet capture analysis

- Windows security logs (Event ID 4624, 4634, 4647, 4778)

- Detecting network connections from mstsc.exe

- Execution of the process rdpclip.exe

- Runs as the clipboard manager on the RDP target if clipboard sharing is enabled

### Output Description

The time of the Connection, the source, the destination, and the user name used

Platforms: Not stated
Domain: Analytic, Network
Subtypes: Map building, Anomaly, Hostflow
Submitted: 2013-07-24
Contributors: MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1021 Remote ServicesT1021.001	Lateral Movement	Medium

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1021Remote Services
.001 Remote Desktop Protocol

D3FEND techniques MITRE maps to this analytic

D3-RTSD Remote Terminal Session Detection

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

Pseudocode

flow_start = search Flow:Start
flow_end = search Flow:End
rdp_start = filter flow_start where (port == "3389")
rdp_end = filter flow_start where (port == "3389")
rdp = group flow_start, flow_end by src_ip, src_port, dest_ip, dest_port
output rdp

SigmaSigma (Localhost Login)

Sigma rule, focusing on RDP localhost login.

MITRE published no code for this implementation.

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

View CAR-2013-07-002 on car.mitre.org