Skip to content

Commit 5396102

Browse files
patel-bhavinpatel-bhavin
authored
Merge pull request #3628 from splunk/rdp_artifacts_and_evasion
rdp_artifacts_and_evasion
2 parents 6300c3b + 4796778 commit 5396102

24 files changed

+951
-217
lines changed

‎detections/endpoint/enable_rdp_in_other_port_number.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Enable RDP In Other Port Number
22
id: 99495452-b899-11eb-96dc-acde48001122
3-
version: 13
4-
date: '2025-07-28'
3+
version: 14
4+
date: '2025-08-07'
55
author: Teoderick Contreras, Splunk, Steven Dick
66
status: production
77
type: TTP
@@ -59,6 +59,7 @@ tags:
5959
analytic_story:
6060
- Prohibited Traffic Allowed or Protocol Mismatch
6161
- Windows Registry Abuse
62+
- Windows RDP Artifacts and Defense Evasion
6263
- Interlock Ransomware
6364
asset_type: Endpoint
6465
mitre_attack_id:

‎detections/endpoint/remote_desktop_process_running_on_system.yml‎

Lines changed: 23 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
name: Remote Desktop Process Running On System
22
id: f5939373-8054-40ad-8c64-cec478a22a4a
3-
version: 11
4-
date: '2025-05-02'
3+
version: 12
4+
date: '2025-08-07'
55
author: David Dorsey, Splunk
66
status: experimental
77
type: Hunting
8-
description: The following analytic detects the execution of the remote desktop process
9-
(mstsc.exe) on systems where it is not typically run. This detection leverages data
10-
from Endpoint Detection and Response (EDR) agents, filtering out systems categorized
11-
as common RDP sources. This activity is significant because unauthorized use of
12-
mstsc.exe can indicate lateral movement or unauthorized remote access attempts.
13-
If confirmed malicious, this could allow an attacker to gain remote control of a
14-
system, potentially leading to data exfiltration, privilege escalation, or further
15-
network compromise.
8+
description: The following analytic detects the execution of the remote desktop
9+
process (mstsc.exe) on systems where it is not typically run. This detection
10+
leverages data from Endpoint Detection and Response (EDR) agents, filtering
11+
out systems categorized as common RDP sources. This activity is significant
12+
because unauthorized use of mstsc.exe can indicate lateral movement or
13+
unauthorized remote access attempts. If confirmed malicious, this could allow
14+
an attacker to gain remote control of a system, potentially leading to data
15+
exfiltration, privilege escalation, or further network compromise.
1616
data_source:
1717
- Sysmon EventID 1
1818
- Windows Event Log Security 4688
@@ -27,21 +27,24 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
2727
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
2828
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)`
2929
| `remote_desktop_process_running_on_system_filter`'
30-
how_to_implement: The detection is based on data that originates from Endpoint Detection
31-
and Response (EDR) agents. These agents are designed to provide security-related
32-
telemetry from the endpoints where the agent is installed. To implement this search,
33-
you must ingest logs that contain the process GUID, process name, and parent process.
34-
Additionally, you must ingest complete command-line executions. These logs must
35-
be processed using the appropriate Splunk Technology Add-ons that are specific to
36-
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
37-
data model. Use the Splunk Common Information Model (CIM) to normalize the field
38-
names and speed up the data modeling process.
39-
known_false_positives: Remote Desktop may be used legitimately by users on the network.
30+
how_to_implement: The detection is based on data that originates from Endpoint
31+
Detection and Response (EDR) agents. These agents are designed to provide
32+
security-related telemetry from the endpoints where the agent is installed. To
33+
implement this search, you must ingest logs that contain the process GUID,
34+
process name, and parent process. Additionally, you must ingest complete
35+
command-line executions. These logs must be processed using the appropriate
36+
Splunk Technology Add-ons that are specific to the EDR product. The logs must
37+
also be mapped to the `Processes` node of the `Endpoint` data model. Use the
38+
Splunk Common Information Model (CIM) to normalize the field names and speed
39+
up the data modeling process.
40+
known_false_positives: Remote Desktop may be used legitimately by users on the
41+
network.
4042
references: []
4143
tags:
4244
analytic_story:
4345
- Hidden Cobra Malware
4446
- Active Directory Lateral Movement
47+
- Windows RDP Artifacts and Defense Evasion
4548
asset_type: Endpoint
4649
mitre_attack_id:
4750
- T1021.001

‎detections/endpoint/windows_default_rdp_file_creation.yml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
name: Windows Default RDP File Creation
2+
id: 00ab0805-4b0f-489f-8eda-ee3de5ed5b1c
3+
version: 1
4+
date: '2025-07-30'
5+
author: Teoderick Contreras, Splunk
6+
status: production
7+
type: Anomaly
8+
description: This detection monitors the creation or modification of the Default.rdp file, typically found in the user's Documents folder. This file is automatically generated or updated by the Remote Desktop Connection client (mstsc.exe) when a user initiates an RDP session. It stores connection settings such as the last-used hostname, screen size, and other preferences. The presence or update of this file strongly suggests that an RDP session has been launched from the system. Since this file is commonly overlooked, it can serve as a valuable artifact in identifying remote access activity, including potential lateral movement or attacker-controlled sessions.
9+
data_source:
10+
- Sysmon EventID 11
11+
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
12+
FROM datamodel=Endpoint.Filesystem where Filesystem.file_path=*\\default.rdp
13+
by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time
14+
Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path
15+
Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product
16+
| `security_content_ctime(lastTime)`
17+
| `security_content_ctime(firstTime)`
18+
|`drop_dm_object_name(Filesystem)`
19+
| `windows_default_rdp_file_creation_filter`'
20+
how_to_implement: To successfully implement this search you need to be ingesting information
21+
on process that include the name of the process responsible for the changes from
22+
your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition,
23+
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
24+
endpoint product.
25+
known_false_positives: False positives will be present, filter as needed or restrict
26+
to critical assets on the perimeter.
27+
references:
28+
- https://medium.com/@bonguides25/how-to-clear-rdp-connections-history-in-windows-cf0ffb67f344
29+
- https://thelocalh0st.github.io/posts/rdp/
30+
drilldown_searches:
31+
- name: View the detection results for - "$user$" and "$dest$"
32+
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
33+
earliest_offset: $info_min_time$
34+
latest_offset: $info_max_time$
35+
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
36+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
37+
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
38+
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
39+
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
40+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
41+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
42+
earliest_offset: $info_min_time$
43+
latest_offset: $info_max_time$
44+
rba:
45+
message: a file related to rdp connection named as default.rdp has been identified on $dest$.
46+
risk_objects:
47+
- field: dest
48+
type: system
49+
score: 10
50+
threat_objects: []
51+
tags:
52+
analytic_story:
53+
- Windows RDP Artifacts and Defense Evasion
54+
asset_type: Endpoint
55+
mitre_attack_id:
56+
- T1021.001
57+
product:
58+
- Splunk Enterprise
59+
- Splunk Enterprise Security
60+
- Splunk Cloud
61+
security_domain: endpoint
62+
tests:
63+
- name: True Positive Test
64+
attack_data:
65+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.001/rdp_creation/deafault_rdp_created.log
66+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
67+
sourcetype: XmlWinEventLog

‎detections/endpoint/windows_default_rdp_file_deletion.yml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
name: Windows Default Rdp File Deletion
2+
id: 30a334c1-f9a5-4fbd-8958-5b65a8435cb2
3+
version: 1
4+
date: '2025-07-30'
5+
author: Teoderick Contreras, Splunk
6+
status: production
7+
type: Anomaly
8+
description: This detection identifies the deletion of the Default.rdp file from a user’s Documents folder. This file is automatically created or updated by the Remote Desktop Connection client (mstsc.exe) whenever a user initiates an RDP session. It contains session configuration data, such as the remote hostname and display settings. While the presence of this file is normal during legitimate RDP usage, its deletion may indicate an attempt to conceal evidence of remote access activity. Threat actors and red team operators often remove Default.rdp as part of post-access cleanup to evade forensic detection. Detecting this action—especially when correlated with recent RDP activity—can help identify defense evasion techniques and uncover potentially malicious use of remote desktop connections. Monitoring for this file's deletion adds an important layer of visibility into user behavior and can serve as an early indicator of interactive attacker presence.
9+
data_source:
10+
- Sysmon EventID 23
11+
- Sysmon EventID 26
12+
search: '`sysmon` EventCode IN ("23", "26") TargetFilename = "*\\default.rdp"
13+
| stats count min(_time) as firstTime, max(_time) as lastTime
14+
by action dest dvc file_path file_hash file_name file_modify_time process_exec process_guid process_id process_name process_path signature signature_id user user_id vendor_product
15+
| `security_content_ctime(firstTime)`
16+
| `security_content_ctime(lastTime)`
17+
| `windows_default_rdp_file_deletion_filter`'
18+
how_to_implement: To successfully implement this search, you need to ingest logs that
19+
include the deleted target file name, process name, and process ID from your endpoints.
20+
If you are using Sysmon, ensure you have at least version 2.0 of the Sysmon TA installed.
21+
known_false_positives: unknown
22+
references:
23+
- https://medium.com/@bonguides25/how-to-clear-rdp-connections-history-in-windows-cf0ffb67f344
24+
- https://thelocalh0st.github.io/posts/rdp/
25+
drilldown_searches:
26+
- name: View the detection results for - "$user$" and "$dest$"
27+
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
28+
earliest_offset: $info_min_time$
29+
latest_offset: $info_max_time$
30+
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
31+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
32+
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
33+
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
34+
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
35+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
36+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
37+
earliest_offset: $info_min_time$
38+
latest_offset: $info_max_time$
39+
rba:
40+
message: a file related to rdp connection named as default.rdp has been deleted on $dest$.
41+
risk_objects:
42+
- field: dest
43+
type: system
44+
score: 40
45+
threat_objects: []
46+
tags:
47+
analytic_story:
48+
- Windows RDP Artifacts and Defense Evasion
49+
asset_type: Endpoint
50+
mitre_attack_id:
51+
- T1070.004
52+
product:
53+
- Splunk Enterprise
54+
- Splunk Enterprise Security
55+
- Splunk Cloud
56+
security_domain: endpoint
57+
tests:
58+
- name: True Positive Test
59+
attack_data:
60+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.004/rdp_deletion/rdp_file_deleted.log
61+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
62+
sourcetype: XmlWinEventLog

‎detections/endpoint/windows_default_rdp_file_unhidden.yml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: Windows Default Rdp File Unhidden
2+
id: f5c1f64b-db59-4913-991e-3dac8adff288
3+
version: 1
4+
date: '2025-07-30'
5+
author: Teoderick Contreras, Splunk
6+
status: production
7+
type: Anomaly
8+
description: This detection identifies the use of attrib.exe to remove hidden (-h) or system (-s) attributes from the Default.rdp file, which is automatically created in a user's Documents folder when a Remote Desktop Protocol (RDP) session is initiated using mstsc.exe. The Default.rdp file stores session configuration details such as the remote host address and screen settings. Unhiding this file is uncommon in normal user behavior and may indicate that an attacker or red team operator is attempting to access or manipulate RDP connection history that was previously hidden—either by default or as part of an earlier anti-forensics effort. This activity may represent part of a broader pattern of reconnaissance or staging for credential reuse, lateral movement, or forensic analysis evasion. Monitoring for this behavior can help uncover suspicious manipulation of user artifacts and highlight interactive attacker activity on a compromised host.
9+
data_source:
10+
- Sysmon EventID 1
11+
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
12+
where Processes.process_name = "attrib.exe" Processes.process IN("*-s*", "*-h*") Processes.process = "*default.rdp*"
13+
by Processes.action
14+
Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
15+
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
16+
Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
17+
Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
18+
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
19+
| `drop_dm_object_name(Processes)`
20+
| `security_content_ctime(firstTime)`
21+
| `security_content_ctime(lastTime)`
22+
| `windows_default_rdp_file_unhidden_filter`'
23+
how_to_implement: The detection is based on data that originates from Endpoint Detection
24+
and Response (EDR) agents. These agents are designed to provide security-related
25+
telemetry from the endpoints where the agent is installed. To implement this search,
26+
you must ingest logs that contain the process GUID, process name, and parent process.
27+
Additionally, you must ingest complete command-line executions. These logs must
28+
be processed using the appropriate Splunk Technology Add-ons that are specific to
29+
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
30+
data model. Use the Splunk Common Information Model (CIM) to normalize the field
31+
names and speed up the data modeling process.
32+
known_false_positives: unknown
33+
references:
34+
- https://medium.com/@bonguides25/how-to-clear-rdp-connections-history-in-windows-cf0ffb67f344
35+
- https://thelocalh0st.github.io/posts/rdp/
36+
drilldown_searches:
37+
- name: View the detection results for - "$user$" and "$dest$"
38+
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
39+
earliest_offset: $info_min_time$
40+
latest_offset: $info_max_time$
41+
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
42+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
43+
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
44+
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
45+
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
46+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
47+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
48+
earliest_offset: $info_min_time$
49+
latest_offset: $info_max_time$
50+
rba:
51+
message: A process unhiding default.rdp on $dest$.
52+
risk_objects:
53+
- field: dest
54+
type: system
55+
score: 40
56+
threat_objects:
57+
- field: parent_process_name
58+
type: parent_process_name
59+
tags:
60+
analytic_story:
61+
- Windows RDP Artifacts and Defense Evasion
62+
asset_type: Endpoint
63+
mitre_attack_id:
64+
- T1021.001
65+
product:
66+
- Splunk Enterprise
67+
- Splunk Enterprise Security
68+
- Splunk Cloud
69+
security_domain: endpoint
70+
tests:
71+
- name: True Positive Test
72+
attack_data:
73+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.001/unhide_file/unhide_file.log
74+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
75+
sourcetype: XmlWinEventLog

0 commit comments

Comments
 (0)