Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
296 detections
Filters
Last updated
All Time
Detection languages
99
93
29
27
18
Contributors
58
47
44
26
18
Categories
89
82
78
61
59
Platforms
262
35
10
9
2
Products / Services
97
56
54
33
28
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
4
2
1
IDS Classtypes
11
7
5
3
1
IDS Protocols
20
7
This analytic detects suspicious modifications to Windows firewall rules via the registry. Specifically, it looks for changes that allow inbound traffic on any port with a public profile. This activity is significant as it may indicate an adversary attempting to grant remote access to a machine by modifying firewall rules, potentially leading to unauthorized remote access, further exploitation, data exfiltration, or lateral movement within the network.
The following analytic detects modifications in the Windows registry to enable remote desktop assistance on a targeted machine. It leverages data from the Endpoint.Registry datamodel, specifically monitoring changes to the "Control\\Terminal Server\\fAllowToGetHelp" registry path. This activity is significant because enabling remote assistance via registry is uncommon and often associated with adversaries or malware like Azorult. If confirmed malicious, this could allow an attacker to remotely access and control the compromised host, leading to potential data exfiltration or further system compromise.
Detects an RDP connection originating from a domain controller. This activity is highly suspicious as domain controllers should not typically initiate RDP connections to other machines. Such an event could indicate lateral movement by an attacker who has compromised the domain controller. The rule specifically filters out connections made by "Microsoft.Tri.Sensor.exe", which is associated with Microsoft Defender for Identity, to avoid false positives from legitimate security operations.
This rule detects RDP traffic communicating with the loopback address (127.0.0.1 or ::1) on either the source or destination port 3389, specifically looking for Windows Filtering Platform (WFP) events (EventID 5156). This behavior is indicative of RDP over a reverse SSH tunnel, where RDP traffic is redirected locally to bypass network restrictions or for covert communication. The rule explicitly filters out events originating from 'AppContainer Loopback' and known Thor processes to reduce false positives.
RDP login with localhost source address may be a tunnelled login
Detects a suspicious RDP session redirect using the 'tscon.exe' utility with the '/dest:rdp-tcp#' command-line argument. This technique can be used by adversaries to hijack an existing RDP session, potentially leading to privilege escalation or lateral movement.
Detects svchost.exe initiating an outbound network connection on TCP port 3389 (RDP) to a loopback address (127.0.0.0/8 or ::1/128). This behavior is indicative of RDP traffic being tunneled, potentially via a reverse SSH tunnel, to bypass network restrictions or for covert remote access.
Detects non-standard tools initiating outbound connections over port 3389, which is commonly used for Remote Desktop Protocol (RDP). This activity can indicate possible lateral movement within a network. The rule filters out legitimate RDP clients and other known third-party tools to reduce false positives. An initial baseline of legitimate RDP tooling is required for effective use.
Detects instances where the svchost.exe process, specifically hosting the RDP terminal services, initiates outbound network connections to target systems on standard HTTP (TCP port 80) or HTTPS (TCP port 443) ports. This behavior is indicative of RDP tunneling, where RDP traffic is encapsulated within web protocols to bypass network restrictions or evade detection.
This rule detects the execution of 'ssh.exe' with command-line arguments indicating RDP port forwarding (tunneling). Specifically, it looks for the presence of ':3389' in the command line, which is the default port for RDP. This activity can be used by adversaries to establish a tunnel for remote access, bypassing network restrictions and potentially exfiltrating data.
Detects cases where ngrok, a legitimate reverse proxy tool, is used to forward traffic to the local Remote Desktop Protocol (RDP) port. This activity can indicate malicious behavior, as adversaries often use tools like ngrok for command and control, bypassing firewalls, or establishing persistent remote access to compromised systems.
This rule detects the potential use of an SSH utility to establish Remote Desktop Protocol (RDP) over a reverse SSH Tunnel. Attackers commonly use this technique to enable routing of network packets that would otherwise not reach their intended destination, bypassing network segmentation or firewalls. The detection logic looks for command-line arguments containing the RDP port ':3389' in conjunction with common SSH tunneling switches such as '-L', '-P', '-R', '-pw', or '-ssh'.
Detects the use of MSTSC (Microsoft Terminal Services Client) with specific command-line arguments ('noconsentprompt' and 'shadow:') which indicates an attempt to perform RDP session shadowing without user consent. This technique can be used for RDP session hijacking.
Detects tampering of RDP Terminal Service/Server sensitive settings by monitoring changes to specific registry keys. This includes scenarios such as enabling RDP connections, allowing multiple RDP sessions per user, or disabling Network-Level Authentication (NLA) by setting the relevant registry values to '0'. Such modifications can facilitate unauthorized access or RDP hijacking.
This rule detects when an authenticated user, who is not authorized for remote logon, attempts to connect to a computer via Remote Desktop. This event can indicate an attacker attempting to discover and access available Windows servers on the network.
Detects when the 'AllowMultipleTSSessions' registry value is enabled, which allows for multiple Remote Desktop Protocol (RDP) sessions to be opened concurrently. Attackers often leverage this to maintain access to an RDP session without disconnecting other legitimate users, facilitating persistence and potentially defense evasion.
RDP login with localhost source address may be a tunnelled login
Detects suspicious Plink tunnel port forwarding to a local port
Detects a suspicious RDP session redirect using tscon.exe
Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389
Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443
Page 14 of 15