Potential Remote Desktop Tunneling

Title: Potential Remote Desktop Tunneling
Status: test
Description:Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.
References:
  -https://www.elastic.co/guide/en/security/current/potential-remote-desktop-tunneling-detected.html
Author: Tim Rauch, Elastic (idea)
Date: 2022-09-27
modified:None
Tags:

• -'attack.lateral-movement'
• -'attack.t1021'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains: ':3389'
  selection_opt:
    CommandLine|contains:
      -' -L '
      -' -P '
      -' -R '
      -' -pw '
      -' -ssh '

  condition:all of selection*
Falsepositives:
  -Unknown
Level: medium