Detected RDP port network activity from to · win.eventdata.destinationPort = 3389

Description

Detected RDP port network activity from $(win.eventdata.sourceIp) to $(win.eventdata.destinationIp)

Query · wazuh

field win.eventdata.destinationPort="^3389$"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

  1. 92108 Detected RDP port network activity from to · win.eventdata.destinationPort = 3389 anchor level 0 this rule
    field win.eventdata.destinationPort="^3389$"

Refined by

1 rule chains off this one, narrowing it further.

Rule dependencies

Depends on

  • composes · Wazuh if_group sysmon_event3
    44 rules in this analytic story
Raw source Detected RDP port network activity from to · win.eventdata.destinationPort = 3389 · Wazuh XML
Esc
Published by Wazuh Core Ruleset ↗, licensed under GPLv2 ↗. Reproduced here unmodified. 
<rule id="92108" level="0">
    <if_group>sysmon_event3</if_group>
    <field name="win.eventdata.destinationPort" type="pcre2">^3389$</field>
    <options>no_full_log</options>
    <description>Detected RDP port network activity from $(win.eventdata.sourceIp) to $(win.eventdata.destinationIp)</description>
    <mitre>
      <id>T1021.001</id>
    </mitre>
  </rule>

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.