Sigma rule: Outbound RDP Connections Over Non-Standard Tools

Rule

Title

Outbound RDP Connections Over Non-Standard Tools

Status

test

Level

high

Author

Markus Neis

Date

2019-05-15

Modified

2024-02-09

File

rules/windows/network_connection/net_connection_win_rdp_outbound_over_non_standard_tools.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement.
An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.

Log source

product

windows

category

network_connection

Detection

selection:
    DestinationPort: 3389
    Initiated: 'true'
filter_main_mstsc:
    Image:
        - 'C:\Windows\System32\mstsc.exe'
        - 'C:\Windows\SysWOW64\mstsc.exe'
filter_optional_dns:
    # Note: https://github.com/SigmaHQ/sigma/pull/2249
    Image: 'C:\Windows\System32\dns.exe'
    SourcePort: 53
    Protocol: 'udp'
filter_optional_avast:
    Image|endswith:
        - '\Avast Software\Avast\AvastSvc.exe'
        - '\Avast\AvastSvc.exe'
filter_optional_sysinternals_rdcman:
    Image|endswith: '\RDCMan.exe'
filter_optional_chrome:
    Image: 'C:\Program Files\Google\Chrome\Application\chrome.exe'
filter_optional_third_party:
    Image|endswith:
        - '\FSAssessment.exe'
        - '\FSDiscovery.exe'
        - '\MobaRTE.exe'
        - '\mRemote.exe'
        - '\mRemoteNG.exe'
        - '\Passwordstate.exe'
        - '\RemoteDesktopManager.exe'
        - '\RemoteDesktopManager64.exe'
        - '\RemoteDesktopManagerFree.exe'
        - '\RSSensor.exe'
        - '\RTS2App.exe'
        - '\RTSApp.exe'
        - '\spiceworks-finder.exe'
        - '\Terminals.exe'
        - '\ws_TunnelService.exe'
filter_optional_thor:
    Image|endswith:
        - '\thor.exe'
        - '\thor64.exe'
filter_optional_splunk:
    Image|startswith: 'C:\Program Files\SplunkUniversalForwarder\bin\'
filter_optional_sentinel_one:
    Image|endswith: '\Ranger\SentinelRanger.exe'
filter_optional_firefox:
    Image: 'C:\Program Files\Mozilla Firefox\firefox.exe'
filter_optional_tsplus:  # Some RAS
    Image:
        - 'C:\Program Files\TSplus\Java\bin\HTML5service.exe'
        - 'C:\Program Files (x86)\TSplus\Java\bin\HTML5service.exe'
filter_optional_null:
    Image: null
filter_optional_empty:
    Image: ''
filter_optional_unknown:
    Image: '<unknown process>'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Third party RDP tools

Tags

• attack.lateral-movement
• attack.t1021.001
• car.2013-07-002

MITRE ATT&CK ids this rule names

• T1021.001

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/network_connection/net_connection_win_rdp_outbound_over_non_standard_tools.yml