RDP Login from Localhost

Title: RDP Login from Localhost
Status: test
Description:RDP login with localhost source address may be a tunnelled login
References:
  -https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html
Author: Thomas Patzke
Date: 2019-01-28
modified:2022-10-09
Tags:

• -'attack.lateral-movement'
• -'car.2013-07-002'
• -'attack.t1021.001'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID: '4624'
    LogonType: '10'
    IpAddress:
      -'::1'
      -'127.0.0.1'

  condition:selection
Falsepositives:
  -Unknown
Level: high