Title:
Potential Remote Desktop Connection to Non-Domain Host
Status:
test
Description:Detects logons using NTLM to hosts that are potentially not part of the domain.
References:
-n/a
Author: James Pemberton
Date: 2020-05-22
modified:2021-11-27
Tags:
- -'attack.command-and-control'
- -'attack.t1219.002'
Logsource:
- product: windows
- service: ntlm
- definition: Requires events from Microsoft-Windows-NTLM/Operational
Detection:
selection:
EventID:
'8001'
TargetName|startswith:
'TERMSRV'
condition:
selection
Falsepositives:
-Host connections to valid domains, exclude these.
-Host connections not using host FQDN.
-Host connections to external legitimate domains.
Level:
medium
