Query: detection rule: Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement. An initial basel
Matching passage: Sigma rule: Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement. An initial basel. Logsource: windows / network_connection. Rule: title: Outbound RDP Connections Over Non-Standard Tools id: ed74fe75-7594-4b4b-ae38-e38e3fd2eb23 status: test description: 'Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement. An initial baseline is required before using this utility to exclude third party RDP tooling that you might use. ' references: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708 author: Markus Neis date: 2019-05-15 modified: 2024-02-09 tags: - attack.lateral-movement - attack.t1021.001 - car.2013-07-002 logsource: category: network_connection product: windows detection: selection: DestinationPort: 3389 Initiated: 'true' filter_main_mstsc: Image: - C:\Windows\System32\mstsc.exe - C:\Windows\SysWOW64\mstsc.exe filter_optional_dns: Image: C:\Windows\System32\dns.exe SourcePort: 53 Protocol: udp filter_optional_avast: Image|endswith: - \Avast Software\Avast\AvastSvc.exe - \Avast\AvastSvc.exe filter_optional_sysinternals_rdcman: Image|endswith: \RDCMan.exe filter_optional_chrome: Image: C:\Program Files\Google\Chrome\Application\chrome.exe filter_optional_third_party: Image|endswith: - \FSAssessment.exe - \FSDiscovery.exe - \MobaRTE.exe - \mRemote.exe - \mRemoteNG.exe - \Passwordstate.exe - \RemoteDesktopManager.exe - \RemoteDesktopManager64.exe - \RemoteDesktopManagerFree.exe - \RSSensor.exe - \RTS2App.exe - \RTSApp.exe - \spiceworks-finder.exe - \Terminals.exe - \ws_TunnelService.exe filter_optional_thor: Image|endswith: - \thor.exe - \thor64.exe filter_optional_splunk: Image|startswith: C:\Program Files\SplunkUniversalForwarder\bin\ filter_optional_sentinel_one: Image|endswith: \Ranger\SentinelRanger.exe filter_optional_firefox: Image: C:\Program Files\Mozilla Firefox\firefox.exe filter_optional_tsplus: Image: - C:\Program Files\TSplus\Java\bin\HTML5service.exe - C:\Program Files (x86)\TSplus\Java\bin\HTML5service.exe filter_optional_null: Image: null filter_optional_empty: Image: '' filter_optional_unknown: Image: <unknown process> condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Third party RDP tools level: high
Near-miss passage: Sigma rule: Detects the expiration of the grace period of Windows Defender. This means protection against viruses, spyware, and othe. Logsource: windows / windefend. Rule: title: Windows Defender Grace Period Expired id: 360a1340-398a-46b6-8d06-99b905dc69d2 related: - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62 type: obsolete status: stable description: 'Detects the expiration of the grace period of Windows Defender. This means protection against viruses, spyware, and other potentially unwanted software is disabled. ' references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5101 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/ author: Ján Trenčanský, frack113 date: 2020-07-28 modified: 2023-11-22 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 5101 condition: selection falsepositives: - Unknown level: high