RDP over Reverse SSH Tunnel via WFP

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•41

This rule detects RDP traffic communicating with the loopback address (127.0.0.1 or ::1) on either the source or destination port 3389, specifically looking for Windows Filtering Platform (WFP) events (EventID 5156). This behavior is indicative of RDP over a reverse SSH tunnel, where RDP traffic is redirected locally to bypass network restrictions or for covert communication. The rule explicitly filters out events originating from 'AppContainer Loopback' and known Thor processes to reduce false positives.