car.2013-07-002

Potential RDP Exploit CVE-2019-0708

Sep 13, 2024 · attack.lateral-movement attack.t1210 car.2013-07-002 ·

Share on:

Detect suspicious error on protocol RDP, potential CVE-2019-0708

Scanner PoC for CVE-2019-0708 RDP RCE Vuln

Sep 13, 2024 · attack.lateral-movement attack.t1210 car.2013-07-002 ·

Share on:

Detects the use of a scanner by zerosum0x0 that discovers targets vulnerable to CVE-2019-0708 RDP RCE aka BlueKeep

Outbound RDP Connections Over Non-Standard Tools

Aug 12, 2024 · attack.lateral-movement attack.t1021.001 car.2013-07-002 ·

Share on:

Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement. An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.

RDP Login from Localhost

Aug 12, 2024 · attack.lateral-movement car.2013-07-002 attack.t1021.001 ·

Share on:

RDP login with localhost source address may be a tunnelled login

RDP Over Reverse SSH Tunnel

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.lateral-movement attack.t1021.001 car.2013-07-002 ·

Share on:

Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389

RDP over Reverse SSH Tunnel WFP

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.lateral-movement attack.t1090.001 attack.t1090.002 attack.t1021.001 car.2013-07-002 ·

Share on:

Detects svchost hosting RDP termsvcs communicating with the loopback address

RDP to HTTP or HTTPS Target Ports

Aug 12, 2024 · attack.command-and-control attack.t1572 attack.lateral-movement attack.t1021.001 car.2013-07-002 ·

Share on:

Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443

Suspicious RDP Redirect Using TSCON

Aug 12, 2024 · attack.lateral-movement attack.t1563.002 attack.t1021.001 car.2013-07-002 ·

Share on:

Detects a suspicious RDP session redirect using tscon.exe

Terminal Service Process Spawn

Aug 12, 2024 · attack.initial-access attack.t1190 attack.lateral-movement attack.t1210 car.2013-07-002 ·

Share on:

Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)