Mstsc.EXE Execution With Local RDP File

Title: Mstsc.EXE Execution With Local RDP File
Status: test
Description:Detects potential RDP connection via Mstsc using a local ".rdp" file
References:
  -https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/
  -https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/
Author: Nasreddine Bencherchali (Nextron Systems), Christopher Peacock @securepeacock
Date: 2023-04-18
modified:2023-04-30
Tags:

• -'attack.command-and-control'
• -'attack.t1219.002'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\mstsc.exe' OriginalFileName:'mstsc.exe'   selection_cli:
    CommandLine|endswith:
      -'.rdp'
      -'.rdp"'

  filter_optional_wsl:
    ParentImage: 'C:\Windows\System32\lxss\wslhost.exe'
    CommandLine|contains: 'C:\ProgramData\Microsoft\WSL\wslg.rdp'
  condition:all of selection_* and not 1 of filter_optional_*
Falsepositives:
  -Likely with legitimate usage of ".rdp" files
Level: low