Detect Remote Desktop Protocol (RDP) activity that could indicate malicious or unauthorised access.
This activity is categorised as Lateral Movement / Remote Desktop Protocol in the killchain and ATT&CK frameworks respectively.
The strategy consists of:
- Collecting Windows authentication logs
- Checking remote logon type events for unauthorised user access
- Collecting netflow data for TCP/3389 (or the Remote Desktop service port if alternate)
Remote Desktop Protocol (RDP) provides remote login and GUI session access to Windows systems that have Remote Desktop Services (RDS) enabled. This functionality can be used by attackers or unauthorised users to gain new access to systems or move laterally across systems within the environment, gaining the privileges of the selected remote user.
The following event IDS could be associated with possibly unauthorised Remote Desktop activity:
| Event Code | Description |
|---|---|
| 4624 | An account was successfully logged on. (Logon Type 10 for Remote Desktop or Terminal Services) |
| 4625 | An account failed to log on. (Logon Type 10 for Remote Desktop or Terminal Services) |
| 4648 | A logon was attempted using explicit credentials. |
| 4778 | A session was reconnected to a Window Station. |
This strategy assumes the following:
- Logon Auditing is enabled and active.
- Audit Other Logon/Logoff Events is enabled and active.
- These logon events are being written to the Windows event log.
A blind spot would occur if the assumptions are untrue, e.g.:
- Windows event logging does not work correctly.
- Logon event auditing is not enabled.
False Positives could easily occur for this ADS for legitimate Remote Desktop login activities:
- Administrators or other authorised users regularly logging in via Remote Desktop.
- Session reconnections to a previously open Remote Desktop session from a legitimate user.
Validation can be performed with the following procedure:
- From a remote location, log in to Remote Desktop with intentionally incorrect credentials (testing event 4625).
- Then, log in with the correct credentials on an account with remote desktop permissions (tests event 4624).
- Disconnect and reconnect to the same remote desktop session (test event 4778).
High priority conditions:
- Invalid login (event 4625) on an administrator account in absence of a following valid login (event 4624).
- Successful login (event 4624) with a user account that is not expected to have remote desktop privileges.
Medium priority conditions:
- Invalid login (event 4625) on an standard user account in absence of a following valid login (event 4624).
Low priority conditions:
- Event 4778
- Event 4648
Validate that the user is authorised to login via remote desktop, and actually initiated the remote desktop login.
- Check if the user is supposed to be permitted to login via remote desktop.
- If the user is permitted to login via remote desktop, check the time and location (IP address, client host) to verify that the login activity is normal.
- This may require a historical record of the user's remote desktop login activity to establish a baseline for what constitutes normal activity.