New Remote Desktop Connection Initiated Via Mstsc.EXE

Title: New Remote Desktop Connection Initiated Via Mstsc.EXE
Status: test
Description:Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md#t1021001---remote-desktop-protocol
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mstsc
Author: frack113
Date: 2022-01-07
modified:2024-06-04
Tags:

• -'attack.lateral-movement'
• -'attack.t1021.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\mstsc.exe' OriginalFileName:'mstsc.exe'   selection_cli:
    CommandLine|contains|windash: ' /v:'
  filter_optional_wsl:
    ParentImage: 'C:\Windows\System32\lxss\wslhost.exe'
    CommandLine|contains: 'C:\ProgramData\Microsoft\WSL\wslg.rdp'
  condition:all of selection_* and not 1 of filter_optional_*
Falsepositives:
  -WSL (Windows Sub System For Linux)
Level: medium