feat(rules): adding new rules for rdp detections in evtx

rules/rdp_attacks/event_id_1149.yaml

@@ -0,0 +1,33 @@
+title: User Authentication Succeeded 
+group: rdp_attacks
+description: User has successfully authenticated an rdp logon
+authors:
+  - ElizaBolton
+
+
+kind: evtx
+level: critical
+status: stable
+timestamp: Event.System.TimeCreated
+
+
+fields:
+  - name: event id
+    to: Event.System.EventID
+  - name: record id
+    to: Event.System.EventRecordID
+  - name: computer
+    to: Event.System.Computer
+  - name: username
+    to: Event.UserData.EventXML.Param1
+  - name: domain
+    to: Event.UserData.EventXML.Param2
+  - name: ip address
+    to: Event.UserData.EventXML.Param3
+  - name: provider
+    to: Event.System.Provider
+
+
+filter:
+  Event.System.EventID: 1149
+  Event.System.Provider: Microsoft-Windows-TerminalServices-RemoteConnectionManager

rules/rdp_attacks/event_id_24.yaml

@@ -0,0 +1,35 @@
+title: RDP Session Disconnected
+group: rdp_attacks
+description: User has disconnected from an RDP session
+authors:
+  - ElizaBolton
+
+
+kind: evtx
+level: critical
+status: stable
+timestamp: Event.System.TimeCreated
+
+
+fields:
+  - name: event id
+    to: Event.System.EventID
+  - name: computer
+    to: Event.System.Computer
+  - name: ip address
+    to: Event.UserData.EventXML.Address
+  - name: username
+    to: Event.UserData.EventXML.User
+  - name: provider
+    to: Event.System.Provider
+
+
+filter:
+  condition: RDP_RELATED and not LOCAL
+
+
+  RDP_RELATED:
+    Event.System.EventID: 24
+    Event.System.Provider: Microsoft-Windows-TerminalServices-LocalSessionManager
+  LOCAL: 
+    Event.UserData.EventXML.Address: "LOCAL"

rules/rdp_attacks/event_id_25.yaml

@@ -0,0 +1,36 @@
+title: RDP Session Connected
+group: rdp_attacks
+description: User has connected to an RDP session
+authors:
+  - ElizaBolton
+
+
+kind: evtx
+level: critical
+status: stable
+timestamp: Event.System.TimeCreated
+
+
+fields:
+  - name: event id
+    to: Event.System.EventID
+  - name: computer
+    to: Event.System.Computer
+  - name: ip address
+    to: Event.UserData.EventXML.Address
+  - name: username
+    to: Event.UserData.EventXML.User
+  - name: provider
+    to: Event.System.Provider
+
+
+filter:
+  condition: RDP_RELATED and not LOCAL
+
+
+  RDP_RELATED:
+    Event.System.EventID: 25
+    Event.System.Provider: Microsoft-Windows-TerminalServices-LocalSessionManager
+  LOCAL: 
+    Event.UserData.EventXML.Address: "LOCAL"
+

rules/rdp_attacks/event_id_4624_logontype_10.yaml

@@ -0,0 +1,32 @@
+title: RDP logon
+group: rdp_attacks
+description: An account was successfully logged onto via RDP
+authors:
+  - ElizaBolton
+
+
+kind: evtx
+level: critical
+status: stable
+timestamp: Event.System.TimeCreated
+
+
+fields:
+  - name: event id
+    to: Event.System.EventID
+  - name: logon type 
+    to: Event.EventData.LogonType  
+  - name: username
+    to: Event.EventData.TargetUserName
+  - name: computer
+    to: Event.System.Computer
+  - name: ip address
+    to: Event.EventData.IpAddress
+  - name: record id
+    to: Event.System.EventRecordID
+
+
+
+filter:  
+  Event.System.EventID: 4624
+  Event.EventData.LogonType: 10