-
Notifications
You must be signed in to change notification settings - Fork 258
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(rules): adding new rules for rdp detections in evtx
- Loading branch information
1 parent
bd709c1
commit 3b2d45b
Showing
4 changed files
with
136 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,33 @@ | ||
title: User Authentication Succeeded | ||
group: rdp_attacks | ||
description: User has successfully authenticated an rdp logon | ||
authors: | ||
- ElizaBolton | ||
|
||
|
||
kind: evtx | ||
level: critical | ||
status: stable | ||
timestamp: Event.System.TimeCreated | ||
|
||
|
||
fields: | ||
- name: event id | ||
to: Event.System.EventID | ||
- name: record id | ||
to: Event.System.EventRecordID | ||
- name: computer | ||
to: Event.System.Computer | ||
- name: username | ||
to: Event.UserData.EventXML.Param1 | ||
- name: domain | ||
to: Event.UserData.EventXML.Param2 | ||
- name: ip address | ||
to: Event.UserData.EventXML.Param3 | ||
- name: provider | ||
to: Event.System.Provider | ||
|
||
|
||
filter: | ||
Event.System.EventID: 1149 | ||
Event.System.Provider: Microsoft-Windows-TerminalServices-RemoteConnectionManager |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,35 @@ | ||
title: RDP Session Disconnected | ||
group: rdp_attacks | ||
description: User has disconnected from an RDP session | ||
authors: | ||
- ElizaBolton | ||
|
||
|
||
kind: evtx | ||
level: critical | ||
status: stable | ||
timestamp: Event.System.TimeCreated | ||
|
||
|
||
fields: | ||
- name: event id | ||
to: Event.System.EventID | ||
- name: computer | ||
to: Event.System.Computer | ||
- name: ip address | ||
to: Event.UserData.EventXML.Address | ||
- name: username | ||
to: Event.UserData.EventXML.User | ||
- name: provider | ||
to: Event.System.Provider | ||
|
||
|
||
filter: | ||
condition: RDP_RELATED and not LOCAL | ||
|
||
|
||
RDP_RELATED: | ||
Event.System.EventID: 24 | ||
Event.System.Provider: Microsoft-Windows-TerminalServices-LocalSessionManager | ||
LOCAL: | ||
Event.UserData.EventXML.Address: "LOCAL" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,36 @@ | ||
title: RDP Session Connected | ||
group: rdp_attacks | ||
description: User has connected to an RDP session | ||
authors: | ||
- ElizaBolton | ||
|
||
|
||
kind: evtx | ||
level: critical | ||
status: stable | ||
timestamp: Event.System.TimeCreated | ||
|
||
|
||
fields: | ||
- name: event id | ||
to: Event.System.EventID | ||
- name: computer | ||
to: Event.System.Computer | ||
- name: ip address | ||
to: Event.UserData.EventXML.Address | ||
- name: username | ||
to: Event.UserData.EventXML.User | ||
- name: provider | ||
to: Event.System.Provider | ||
|
||
|
||
filter: | ||
condition: RDP_RELATED and not LOCAL | ||
|
||
|
||
RDP_RELATED: | ||
Event.System.EventID: 25 | ||
Event.System.Provider: Microsoft-Windows-TerminalServices-LocalSessionManager | ||
LOCAL: | ||
Event.UserData.EventXML.Address: "LOCAL" | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,32 @@ | ||
title: RDP logon | ||
group: rdp_attacks | ||
description: An account was successfully logged onto via RDP | ||
authors: | ||
- ElizaBolton | ||
|
||
|
||
kind: evtx | ||
level: critical | ||
status: stable | ||
timestamp: Event.System.TimeCreated | ||
|
||
|
||
fields: | ||
- name: event id | ||
to: Event.System.EventID | ||
- name: logon type | ||
to: Event.EventData.LogonType | ||
- name: username | ||
to: Event.EventData.TargetUserName | ||
- name: computer | ||
to: Event.System.Computer | ||
- name: ip address | ||
to: Event.EventData.IpAddress | ||
- name: record id | ||
to: Event.System.EventRecordID | ||
|
||
|
||
|
||
filter: | ||
Event.System.EventID: 4624 | ||
Event.EventData.LogonType: 10 |