RDP Over Reverse SSH Tunnel

Title: RDP Over Reverse SSH Tunnel
Status: test
Description:Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389
References:
  -https://twitter.com/cyb3rops/status/1096842275437625346
Author: Samir Bousseaden
Date: 2019-02-16
modified:2024-03-12
Tags:

• -'attack.command-and-control'
• -'attack.t1572'
• -'attack.lateral-movement'
• -'attack.t1021.001'
• -'car.2013-07-002'

Logsource:

• category: network_connection
• product: windows

Detection:
  selection_img:
    Image|endswith: '\svchost.exe'
    Initiated: 'true'
    SourcePort: '3389'
  selection_destination:
    DestinationIp|cidr:
      -'127.0.0.0/8'
      -'::1/128'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high