RDP to HTTP or HTTPS Target Ports

Title: RDP to HTTP or HTTPS Target Ports
Status: test
Description:Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443
References:
  -https://twitter.com/tekdefense/status/1519711183162556416?s=12&t=OTsHCBkQOTNs1k3USz65Zg
  -https://www.mandiant.com/resources/bypassing-network-restrictions-through-rdp-tunneling
Author: Florian Roth (Nextron Systems)
Date: 2022-04-29
modified:2022-07-14
Tags:

• -'attack.command-and-control'
• -'attack.t1572'
• -'attack.lateral-movement'
• -'attack.t1021.001'
• -'car.2013-07-002'

Logsource:

• category: network_connection
• product: windows

Detection:
  selection:
    Image|endswith: '\svchost.exe'
    Initiated: 'true'
    SourcePort: '3389'
    DestinationPort:
      -'80'
      -'443'

  condition:selection
Falsepositives:
  -Unknown
Level: high