Versions (2)
Version DetailsCurrent
Rev: 8 • Jan 8, 2025, 12:00 PM🐾 - 🚨 Suspicious RDP connection from non 🪟 MSTSC client - Possible Lateral Movement 🥷 - T1021.001
alert tcp any any -> any any (msg:"🐾 - 🚨 Suspicious RDP connection from non 🪟 MSTSC client - Possible Lateral Movement 🥷 - T1021.001"; flow:to_server, stateless; content:"cookie"; nocase; content:"mstshash"; nocase; content:"|03 00 00 00|"; fast_pattern; content:!"|0b 00 00 00|"; reference:url,https://attack.mitre.org/techniques/T1021/001/; metadata:attack_target Client_and_Server, signature_severity Major, mitre_tactic_id TA0008, mitre_tactic_name Lateral_Movement, mitre_technique_id T1021.001, mitre_technique_name Remote_Services-Remote_Desktop_Protocol, created_at 2025_01_08, updated_at 2025_01_08; sid:3321411; rev:8; classtype:policy-violation;)
Jan 8, 2025, 12:00 PM
Jan 8, 2025, 12:00 PM
Jan 8, 2025, 10:34 PM
Jan 8, 2025, 10:34 PM
rules/PAW-PATRULES_VULN.rules