Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
51 detections
Filters
Last updated
All Time
Detection languages
27
14
4
2
2
Contributors
9
8
6
5
4
Categories
27
19
13
8
7
Platforms
43
6
5
5
2
Products / Services
13
11
9
6
6
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
IDS Protocols
2
This query was originally published in the threat analytics report, RDP ransomware persists as Wadhrama.
The ransomware known as Wadhrama has been used in human-operated attacks that follow a particular pattern. The attackers often use Remote Desktop Protocol (RDP) to gain initial access to a device or network, exfiltrate credentials, and maintain persistance.
The following query checks for possible Wadhrama-related activity, by detecting the technique these attackers have used in the past to dump credentials.
Other techniques used by the group associated with Wadhrama are listed under See also.
Reference - https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Wadhrama
The ransomware known as Wadhrama has been used in human-operated attacks that follow a particular pattern. The attackers often use Remote Desktop Protocol (RDP) to gain initial access to a device or network, exfiltrate credentials, and maintain persistance.
The following query checks for possible Wadhrama-related activity, by detecting the technique these attackers have used in the past to dump credentials.
Other techniques used by the group associated with Wadhrama are listed under See also.
Reference - https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Wadhrama
This rule detects the execution of 'tscon.exe' with SYSTEM privileges. 'tscon.exe' is a legitimate Windows utility used to connect to or disconnect from a session on a Remote Desktop Session Host server. When executed as SYSTEM, it can be used by an attacker to hijack an active RDP session without requiring credentials or user interaction, leading to privilege escalation and lateral movement. This technique is often referred to as RDP session hijacking.
This rule detects the execution of 'tscon.exe' with 'System' integrity level. This combination is indicative of potential RDP session hijacking activity, where an attacker takes over an existing RDP session without needing credentials or prompting the user. The 'tscon.exe' utility is a legitimate Windows tool used to connect to or disconnect from a session on a Remote Desktop Session Host server, but its execution with System integrity is a strong indicator of malicious intent in this context.
Detects a suspicious RDP session redirect using the 'tscon.exe' utility with the '/dest:rdp-tcp#' command-line argument. This technique can be used by adversaries to hijack an existing RDP session, potentially leading to privilege escalation or lateral movement.
Detects the use of MSTSC (Microsoft Terminal Services Client) with specific command-line arguments ('noconsentprompt' and 'shadow:') which indicates an attempt to perform RDP session shadowing without user consent. This technique can be used for RDP session hijacking.
Detects tampering of RDP Terminal Service/Server sensitive settings by monitoring changes to specific registry keys. This includes scenarios such as enabling RDP connections, allowing multiple RDP sessions per user, or disabling Network-Level Authentication (NLA) by setting the relevant registry values to '0'. Such modifications can facilitate unauthorized access or RDP hijacking.
Detects tampering of RDP Terminal Service/Server sensitive settings. This includes modifications to allow unsolicited remote assistance, disable security settings, or enable RDP via specific registry keys. It also covers changes related to RDP hijacking via the 'ServiceDll' key and the 'Shadow' RDP technique.
Detects a suspicious RDP session redirect using tscon.exe
Detects RDP session hijacking by using MSTSC shadowing
Page 3 of 3