Query: write Sigma for Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to lo
Matching passage: Sigma rule: Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to lo. Logsource: windows / registry_set. Rule: title: Default RDP Port Changed to Non Standard Port id: 509e84b9-a71a-40e0-834f-05470369bd1e status: test description: 'Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md author: frack113 date: 2022-01-01 modified: 2024-03-25 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.010 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Control\Terminal Server\WinStations\RDP-Tcp\PortNumber filter_main_port: Details: DWORD (0x00000d3d) condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_change_rdp_port/info.yml simulation: - type: atomic-red-team name: Changing RDP Port to Non Standard Port via Powershell technique: T1021.001 atomic_guid: 2f840dd4-8a2e-4f44-beb3-6b2399ea3771 - type: atomic-red-team name: Changing RDP Port to Non Standard Port via Command_Prompt technique: T1021.001 atomic_guid: 74ace21e-a31c-4f7d-b540-53e4eb6d1f73
Near-miss passage: Sigma rule: Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file. Logsource: windows / ps_script. Rule: title: Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell id: db885529-903f-4c5d-9864-28fe199e6370 related: - id: 435e10e4-992a-4281-96f3-38b11106adde type: similar status: test description: Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file references: - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/ - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-17 tags: - attack.discovery - attack.t1033 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'Get-ADComputer ' - ' -Filter \*' ScriptBlockText|contains: - ' | Select ' - Out-File - Set-Content - Add-Content condition: selection falsepositives: - Legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often level: medium