🐾 - 🚨 Suspicious RDP connection from non 🪟 MSTSC client - Possible Lateral Movement 🥷 - T1021.001

SID: 3321411Rev: 812 views
History
Sourcepawpatrules
CreatedJanuary 8, 2025
UpdatedJanuary 8, 2025
Classificationpolicy-violation
alert tcp any any -> any any (msg:"🐾 - 🚨 Suspicious RDP connection from non 🪟 MSTSC client - Possible Lateral Movement 🥷 - T1021.001"; flow:to_server, stateless; content:"cookie"; nocase; content:"mstshash"; nocase; content:"|03 00 00 00|"; fast_pattern; content:!"|0b 00 00 00|"; reference:url,https://attack.mitre.org/techniques/T1021/001/; metadata:attack_target Client_and_Server, signature_severity Major, mitre_tactic_id TA0008, mitre_tactic_name Lateral_Movement, mitre_technique_id T1021.001, mitre_technique_name Remote_Services-Remote_Desktop_Protocol, created_at 2025_01_08, updated_at 2025_01_08; sid:3321411; rev:8; classtype:policy-violation;)

References

urlhttps://attack.mitre.org/techniques/T1021/001/

Metadata

attack targetClient_and_Server
signature severityMajor
mitre tactic idTA0008
mitre tactic nameLateral_Movement
mitre technique idT1021.001
mitre technique nameRemote_Services-Remote_Desktop_Protocol
created at2025_01_08
updated at2025_01_08

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!