New RDP Connection Initiated From Domain Controller

Description

Detects an RDP connection originating from a domain controller.

Query · sigma

selection_connection:
  Initiated: 'True'
  DestinationPort: 3389
selection_hosts:
  Computer|expand: '%domain_controller_hostnames%'
filter_optional_defender_identity:
  Image|endswith: \Microsoft.Tri.Sensor.exe
condition: all of selection_* and not 1 of filter_*

Known false positives

  • Legitimate administration activity
Raw source New RDP Connection Initiated From Domain Controller · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: New RDP Connection Initiated From Domain Controller
id: fda34293-718e-4b36-b018-38caab0d1209
status: test
description: Detects an RDP connection originating from a domain controller.
references:
    - Internal Research
author: Josh Nickels
date: 2024-05-10
tags:
    - attack.lateral-movement
    - attack.t1021
logsource:
    product: windows
    category: network_connection
detection:
    selection_connection:
        Initiated: 'True'
        DestinationPort: 3389
    selection_hosts:
        Computer|expand: '%domain_controller_hostnames%'
    filter_optional_defender_identity:
        Image|endswith: '\Microsoft.Tri.Sensor.exe' # Microsoft Defender for Identity service makes port 3389 connections to hosts
    condition: all of selection_* and not 1 of filter_*
falsepositives:
    - Legitimate administration activity
level: high

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.