Potential RDP Tunneling Via Plink

Title: Potential RDP Tunneling Via Plink
Status: test
Description:Execution of plink to perform data exfiltration and tunneling
References:
  -https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
Author: Florian Roth (Nextron Systems)
Date: 2022-08-04
modified:2023-01-27
Tags:

• -'attack.command-and-control'
• -'attack.t1572'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_a:
    Image|endswith: '\plink.exe'
    CommandLine|contains: ':127.0.0.1:3389'
  selection_b1:
    Image|endswith: '\plink.exe'
    CommandLine|contains: ':3389'
  selection_b2:
    CommandLine|contains:
      -' -P 443'
      -' -P 22'

  condition:selection_a or all of selection_b*
Falsepositives:
  -Unknown
Level: high