title: Suspicious Outbound RDP Connections
id: ed74fe75-7594-4b4b-ae38-e38e3fd2eb23
status: test
description: Detects Non-Standard Tools Connecting to TCP port 3389 indicating possible lateral movement
author: Markus Neis - Swisscom
references:
  - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708
date: 2019/05/15
modified: 2022/06/20
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 3389
    Initiated: 'true'
  filter:
    - Image|endswith:
      - '\mstsc.exe'
      - '\RTSApp.exe'
      - '\RTS2App.exe'
      - '\RDCMan.exe'
      - '\ws_TunnelService.exe'
      - '\RSSensor.exe'
      - '\RemoteDesktopManagerFree.exe'
      - '\RemoteDesktopManager.exe'
      - '\RemoteDesktopManager64.exe'
      - '\mRemoteNG.exe'
      - '\mRemote.exe'
      - '\Terminals.exe'
      - '\spiceworks-finder.exe'
      - '\FSDiscovery.exe'
      - '\FSAssessment.exe'
      - '\MobaRTE.exe'
      - '\chrome.exe'
      - '\System32\dns.exe'
      - '\thor.exe'
      - '\thor64.exe'
      - '\Passwordstate.exe'
      - '\Avast Software\Avast\AvastSvc.exe'
      - '\Ranger\SentinelRanger.exe' # sentinel one
      - '\Avast\AvastSvc.exe'
    - Image|startswith: 'C:\Program Files\SplunkUniversalForwarder\bin\'
  condition: selection and not filter
falsepositives:
  - Other Remote Desktop RDP tools
  - Domain controller using dns.exe
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.001
  - car.2013-07-002
