RDP (Remote Desktop Protocol) from the Internet

  1[metadata]
  2creation_date = "2020/02/18"
  3integration = ["network_traffic", "panw", "pfsense", "zeek", "corelight"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10This rule detects network events that may indicate the use of RDP traffic from the Internet. RDP is commonly used by
 11system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be
 12directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or
 13backdoor vector.
 14"""
 15false_positives = [
 16    """
 17    Some network security policies allow RDP directly from the Internet but usage that is unfamiliar to server or
 18    network owners can be unexpected and suspicious. RDP services may be exposed directly to the Internet in some
 19    networks such as cloud environments. In such cases, only RDP gateways, bastions or jump servers may be expected
 20    expose RDP directly to the Internet and can be exempted from this rule. RDP may be required by some work-flows such
 21    as remote access and support for specialized software products and servers. Such work-flows are usually known and
 22    not unexpected.
 23    """,
 24]
 25from = "now-9m"
 26index = ["logs-network_traffic.*", "logs-panw.panos*", "logs-pfsense.log-*", "logs-zeek.*", "logs-corelight.*"]
 27language = "kuery"
 28license = "Elastic License v2"
 29name = "RDP (Remote Desktop Protocol) from the Internet"
 30references = ["https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml"]
 31risk_score = 47
 32rule_id = "8c1bdde8-4204-45c0-9e0c-c85ca3902488"
 33severity = "medium"
 34tags = [
 35    "Tactic: Command and Control",
 36    "Tactic: Lateral Movement",
 37    "Tactic: Initial Access",
 38    "Domain: Endpoint",
 39    "Use Case: Threat Detection",
 40    "Data Source: Corelight",
 41    "Data Source: PAN-OS",
 42    "Data Source: Network Traffic",
 43    "Data Source: pfSense",
 44    "Data Source: Zeek",
 45    "Resources: Investigation Guide",
 46    "Noise: High",
 47    "Performance: Normal",
 48    "Profile: Aggressive",
 49    "Rule Type: Custom Query (KQL)",
 50    "Domain: Network",
 51    "Data Source: Network Packet Capture",
 52]
 53timeline_id = "300afc76-072d-4261-864d-4149714bf3f1"
 54timeline_title = "Comprehensive Network Timeline"
 55timestamp_override = "event.ingested"
 56type = "query"
 57
 58query = '''
 59(data_stream.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and
 60  network.transport:tcp and (destination.port:3389 or data_stream.dataset:zeek.rdp) and
 61  not source.ip:(
 62    10.0.0.0/8 or
 63    127.0.0.0/8 or
 64    169.254.0.0/16 or
 65    172.16.0.0/12 or
 66    192.0.0.0/24 or
 67    192.0.0.0/29 or
 68    192.0.0.8/32 or
 69    192.0.0.9/32 or
 70    192.0.0.10/32 or
 71    192.0.0.170/32 or
 72    192.0.0.171/32 or
 73    192.0.2.0/24 or
 74    192.31.196.0/24 or
 75    192.52.193.0/24 or
 76    192.168.0.0/16 or
 77    192.88.99.0/24 or
 78    224.0.0.0/4 or
 79    100.64.0.0/10 or
 80    192.175.48.0/24 or
 81    198.18.0.0/15 or
 82    198.51.100.0/24 or
 83    203.0.113.0/24 or
 84    240.0.0.0/4 or
 85    "::1" or
 86    "FE80::/10" or
 87    "FF00::/8"
 88  ) and
 89  destination.ip:(
 90    10.0.0.0/8 or
 91    172.16.0.0/12 or
 92    192.168.0.0/16
 93  ) and
 94  not (
 95    data_stream.dataset:"panw.panos" and (
 96      event.action:("flow_dropped" or "flow_denied") or
 97      network.application:("incomplete" or "insufficient-data" or "not-applicable")
 98    )
 99  )
100'''
101note = """## Triage and analysis
102
103> **Disclaimer**:
104> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
105
106### Investigating RDP (Remote Desktop Protocol) from the Internet
107
108RDP allows administrators to remotely manage systems, but exposing it to the internet poses security risks. Adversaries exploit RDP for unauthorized access, often using it as an entry point for attacks. The detection rule identifies suspicious RDP traffic by monitoring TCP connections on port 3389 from external IPs, flagging potential threats for further investigation.
109
110### Possible investigation steps
111
112- Review the source IP address flagged in the alert to determine if it is known or associated with any previous malicious activity. Check threat intelligence sources for any reported malicious behavior.
113- Analyze the destination IP address to confirm it belongs to your internal network (10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16) and identify the specific system targeted by the RDP connection.
114- Examine network logs for any unusual or unexpected RDP traffic patterns from the source IP, such as repeated connection attempts or connections at odd hours, which may indicate brute force attempts or unauthorized access.
115- Check for any recent changes or updates to firewall rules or security policies that might have inadvertently exposed RDP to the internet.
116- Investigate the user accounts involved in the RDP session to ensure they are legitimate and have not been compromised. Look for any signs of unauthorized access or privilege escalation.
117- Correlate the RDP traffic with other security events or alerts to identify any potential lateral movement or further malicious activity within the network.
118
119### False positive analysis
120
121- Internal testing or maintenance activities may trigger the rule if RDP is temporarily exposed to the internet. To manage this, create exceptions for known internal IP addresses or scheduled maintenance windows.
122- Legitimate third-party vendors or partners accessing systems via RDP for support purposes can be mistaken for threats. Establish a list of trusted external IP addresses and exclude them from the rule.
123- Misconfigured network devices or security tools might inadvertently expose RDP to the internet, leading to false positives. Regularly audit network configurations and update the rule to exclude known benign sources.
124- Cloud-based services or remote work solutions that use RDP over the internet can be flagged. Identify and whitelist these services' IP ranges to prevent unnecessary alerts.
125
126### Response and remediation
127
128- Immediately block the external IP address identified in the alert from accessing the network to prevent further unauthorized RDP connections.
129- Isolate the affected system from the network to contain any potential compromise and prevent lateral movement by the threat actor.
130- Conduct a thorough review of the affected system for signs of compromise, such as unauthorized user accounts, changes in system configurations, or the presence of malware.
131- Reset credentials for any accounts that were accessed or potentially compromised during the incident to prevent unauthorized access.
132- Apply security patches and updates to the affected system and any other systems with RDP enabled to mitigate known vulnerabilities.
133- Implement network segmentation to restrict RDP access to only trusted internal IP addresses and consider using a VPN for secure remote access.
134- Escalate the incident to the security operations center (SOC) or incident response team for further analysis and to determine if additional systems are affected."""
135
136
137[[rule.threat]]
138framework = "MITRE ATT&CK"
139
140[rule.threat.tactic]
141id = "TA0011"
142name = "Command and Control"
143reference = "https://attack.mitre.org/tactics/TA0011/"
144
145[[rule.threat]]
146framework = "MITRE ATT&CK"
147
148[[rule.threat.technique]]
149id = "T1021"
150name = "Remote Services"
151reference = "https://attack.mitre.org/techniques/T1021/"
152
153[[rule.threat.technique.subtechnique]]
154id = "T1021.001"
155name = "Remote Desktop Protocol"
156reference = "https://attack.mitre.org/techniques/T1021/001/"
157
158[rule.threat.tactic]
159id = "TA0008"
160name = "Lateral Movement"
161reference = "https://attack.mitre.org/tactics/TA0008/"
162
163[[rule.threat]]
164framework = "MITRE ATT&CK"
165
166[[rule.threat.technique]]
167id = "T1133"
168name = "External Remote Services"
169reference = "https://attack.mitre.org/techniques/T1133/"
170
171[[rule.threat.technique]]
172id = "T1190"
173name = "Exploit Public-Facing Application"
174reference = "https://attack.mitre.org/techniques/T1190/"
175
176[rule.threat.tactic]
177id = "TA0001"
178name = "Initial Access"
179reference = "https://attack.mitre.org/tactics/TA0001/"