attack.t1021.001 | Detection.FYI

Denied Access To Remote Desktop

Aug 12, 2024 · attack.lateral-movement attack.t1021.001 ·
Share on:

This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop. Often, this event can be generated by attackers when searching for available windows servers in the network.

Read More
Hermetic Wiper TG Process Patterns

Aug 12, 2024 · attack.execution attack.lateral-movement attack.t1021.001 detection.emerging-threats ·
Share on:

Detects process execution patterns found in intrusions related to the Hermetic Wiper malware attacks against Ukraine in February 2022

Read More
New Remote Desktop Connection Initiated Via Mstsc.EXE

Aug 12, 2024 · attack.lateral-movement attack.t1021.001 ·
Share on:

Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Read More
Outbound RDP Connections Over Non-Standard Tools

Aug 12, 2024 · attack.lateral-movement attack.t1021.001 car.2013-07-002 ·
Share on:

Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement. An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.

Read More
Port Forwarding Activity Via SSH.EXE

Aug 12, 2024 · attack.command-and-control attack.lateral-movement attack.t1572 attack.t1021.001 attack.t1021.004 ·
Share on:

Detects port forwarding activity via SSH.exe

Read More
Potential Tampering With RDP Related Registry Keys Via Reg.EXE

Aug 12, 2024 · attack.defense-evasion attack.lateral-movement attack.t1021.001 attack.t1112 ·
Share on:

Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values

Read More
Publicly Accessible RDP Service

Aug 12, 2024 · attack.lateral-movement attack.t1021.001 ·
Share on:

Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service.

Read More
RDP Login from Localhost

Aug 12, 2024 · attack.lateral-movement car.2013-07-002 attack.t1021.001 ·
Share on:

RDP login with localhost source address may be a tunnelled login

Read More
RDP Over Reverse SSH Tunnel

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.lateral-movement attack.t1021.001 car.2013-07-002 ·
Share on:

Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389

Read More
RDP over Reverse SSH Tunnel WFP

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.lateral-movement attack.t1090.001 attack.t1090.002 attack.t1021.001 car.2013-07-002 ·
Share on:

Detects svchost hosting RDP termsvcs communicating with the loopback address

Read More
RDP to HTTP or HTTPS Target Ports

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.lateral-movement attack.t1021.001 car.2013-07-002 ·
Share on:

Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443

Read More
Suspicious Plink Port Forwarding

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.lateral-movement attack.t1021.001 ·
Share on:

Detects suspicious Plink tunnel port forwarding to a local port

Read More
Suspicious RDP Redirect Using TSCON

Aug 12, 2024 · attack.lateral-movement attack.t1563.002 attack.t1021.001 car.2013-07-002 ·
Share on:

Detects a suspicious RDP session redirect using tscon.exe

Read More
User Added to Remote Desktop Users Group

Aug 12, 2024 · attack.persistence attack.lateral-movement attack.t1133 attack.t1136.001 attack.t1021.001 ·
Share on:

Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".

Read More
Enabling RDP service via reg.exe command execution

Aug 10, 2024 · attack.defense_evasion attack.lateral_movement attack.t1021.001 attack.t1112 ·
Share on:

Detects the execution of reg.exe and subsequent command line arguments for enabling RDP service on the host

Read More
Enabling RDP service via reg.exe command execution

Feb 22, 2024 · attack.defense_evasion attack.lateral_movement attack.t1021.001 attack.t1112 ·
Share on:

Detects the execution of reg.exe and subsequent command line arguments for enabling RDP service on the host

Read More