
title: RDP Over Reverse SSH Tunnel
author: Samir Bousseaden
date: 2019/02/16
description: Detects svchost hosting RDP termsvcs communicating with the loopback
  address and on TCP port 3389
detection:
  SELECTION_1:
    EventID: 3
  SELECTION_2:
    Image: '*\svchost.exe'
  SELECTION_3:
    Initiated: 'true'
  SELECTION_4:
    SourcePort: 3389
  SELECTION_5:
    DestinationIp:
    - 127.*
  SELECTION_6:
    DestinationIp:
    - ::1
  condition: (SELECTION_1 and (SELECTION_2 and SELECTION_3 and SELECTION_4) and (SELECTION_5
    or SELECTION_6))
falsepositives:
- unknown
id: 5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4
level: high
logsource:
  category: network_connection
  product: windows
modified: 2021/05/11
references:
- https://twitter.com/SBousseaden/status/1096148422984384514
status: experimental
tags:
- attack.command_and_control
- attack.t1572
- attack.lateral_movement
- attack.t1021.001
- attack.t1076
- car.2013-07-002
ruletype: SIGMA
