Situational AwarenessCAR-2016-04-005
Remote Desktop Logon
Hypothesis and description
A remote desktop logon, through RDP, may be typical of a system administrator or IT support, but only from select workstations. Monitoring remote desktop logons and comparing to known/approved originating systems can detect lateral movement of an adversary.
- Platforms
- Windows
- Domain
- Host
- Subtypes
- Login
- Submitted
- 2016-04-19
- Contributors
- MITRE/NSA
ATT&CK coverage
| Technique | Tactics | Coverage |
|---|---|---|
| T1021 Remote ServicesT1021.001 | Lateral Movement | Moderate |
1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
D3FEND techniques MITRE maps to this analytic
Pseudocode and implementations
Pseudocode
Look in the system logs for remote logons using RDP.
[EventCode] == 4624 and
[AuthenticationPackageName] == 'Negotiate' and
[Severity] == "Information" and
[LogonType] == 10Sigma
Sigma version of the above pseudocode, with some modifications.
MITRE published no code for this implementation.
LogPointData model: LogPoint native
LogPoint version of the above pseudocode.
norm_id=WinServer event_id=4624 package="Negotiate" log_level="INFO" logon_type=10Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-STSession Termination1 shared
- D3-CAAConnection Attempt Analysis1 shared
- D3-APCAApplication Protocol Command Analysis1 shared
- D3-CSPPClient-server Payload Profiling1 shared
- D3-NTCDNetwork Traffic Community Deviation1 shared
- D3-NTFNetwork Traffic Filtering1 shared
- D3-NTSANetwork Traffic Signature Analysis1 shared
- D3-PHDURAPer Host Download-Upload Ratio Analysis1 shared
- D3-PMADProtocol Metadata Anomaly Detection1 shared
- D3-RTSDRemote Terminal Session Detection1 shared
- D3-UGLPAUser Geolocation Logon Pattern Analysis1 shared