Query: detection rule: Detects svchost hosting RDP termsvcs communicating with the loopback address
Matching passage: Sigma rule: Detects svchost hosting RDP termsvcs communicating with the loopback address. Logsource: windows / security. Rule: title: RDP over Reverse SSH Tunnel WFP id: 5bed80b6-b3e8-428e-a3ae-d3c757589e41 status: test description: Detects svchost hosting RDP termsvcs communicating with the loopback address references: - https://twitter.com/SBousseaden/status/1096148422984384514 - https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/44fbe85f72ee91582876b49678f9a26292a155fb/Command%20and%20Control/DE_RDP_Tunnel_5156.evtx author: Samir Bousseaden date: 2019-02-16 modified: 2022-09-02 tags: - attack.command-and-control - attack.lateral-movement - attack.t1090.001 - attack.t1090.002 - attack.t1021.001 - car.2013-07-002 logsource: product: windows service: security detection: selection: EventID: 5156 sourceRDP: SourcePort: 3389 DestAddress: - 127.* - ::1 destinationRDP: DestPort: 3389 SourceAddress: - 127.* - ::1 filter_app_container: FilterOrigin: AppContainer Loopback filter_thor: Application|endswith: - \thor.exe - \thor64.exe condition: selection and ( sourceRDP or destinationRDP ) and not 1 of filter* falsepositives: - Programs that connect locally to the RDP port level: high
Near-miss passage: Sigma rule: Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publishe. Logsource: windows / process_creation. Rule: title: Suspicious Microsoft Office Child Process id: 438025f9-5856-4663-83f7-52f878a70a50 related: - id: c27515df-97a9-4162-8a60-dc0eeb51b775 type: derived - id: e1693bc8-7168-4eab-8718-cdcaa68a1738 type: derived - id: 23daeb52-e6eb-493c-8607-c4f0246cb7d8 type: obsolete - id: 518643ba-7d9c-4fa5-9f37-baed36059f6a type: obsolete - id: 04f5363a-6bca-42ff-be70-0d28bf629ead type: obsolete status: test description: Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.) references: - https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100 - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml - https://github.com/splunk/security_content/blob/300af51b88ad5d5b27ce4f5f54e4d6e6a3a2c06d/detections/endpoint/office_spawning_control.yml - https://twitter.com/andythevariable/status/1576953781581144064?s=20&t=QiJILvK4ZiBdR8RJe24u-A - https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml - https://www.vmray.com/analyses/2d2fa29185ad/report/overview.html - https://app.any.run/tasks/c903e9c8-0350-440c-8688-3881b556b8e0/ author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io date: 2018-04-06 modified: 2023-04-24 tags: - attack.execution - attack.stealth - attack.t1047 - attack.t1204.002 - attack.t1218.010 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \EQNEDT32.EXE - \EXCEL.EXE - \MSACCESS.EXE - \MSPUB.exe - \ONENOTE.EXE - \POWERPNT.exe - \VISIO.exe - \WINWORD.EXE - \wordpad.exe - \wordview.exe selection_child_processes: - OriginalFileName: - bitsadmin.exe - CertOC.exe - CertUtil.exe - Cmd.Exe - CMSTP.EXE - cscript.exe - curl.exe - HH.exe - IEExec.exe - InstallUtil.exe - javaw.exe - Microsoft.Workflow.Compiler.exe - msdt.exe -