title: Netsh RDP Port Opening
id: 01aeb693-138d-49d2-9403-c4f52d7d3d62
status: test
description: Detects netsh commands that opens the port 3389 used for RDP, used in Sarwent Malware
author: Sander Wiebing
references:
  - https://labs.sentinelone.com/sarwent-malware-updates-command-detonation/
date: 2020/05/23
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    CommandLine|contains|all:
      - netsh
      - firewall add portopening
      - tcp 3389
  selection2:
    CommandLine|contains|all:
      - netsh
      - advfirewall firewall add rule
      - action=allow
      - protocol=TCP
      - localport=3389
  condition: 1 of selection*
falsepositives:
  - Legitimate administration
level: high
tags:
  - attack.defense_evasion
  - attack.t1562.004
