Sysmon Terminal Services Monitoring: Complete Detection Guide#

This comprehensive guide covers the implementation of advanced Terminal Services monitoring using Sysmon, focusing on detecting RDP attacks, lateral movement, and suspicious remote access activities. Learn to configure Sysmon for comprehensive Terminal Services visibility and build effective detection rules.

Table of Contents#

Understanding Terminal Services Security#

Terminal Services (Remote Desktop Services) represent a critical attack vector in Windows environments. Attackers often target RDP services for:

Initial Access: Exploiting weak credentials or vulnerabilities
Lateral Movement: Moving between systems using compromised accounts
Persistence: Maintaining access through legitimate remote services
Privilege Escalation: Exploiting RDP session vulnerabilities
Data Exfiltration: Using clipboard and file transfer capabilities

Common Terminal Services Threats#

Brute Force Attacks: Automated credential guessing
Pass-the-Hash: Using stolen credentials for authentication
Session Hijacking: Taking over active RDP sessions
BlueKeep Exploitation: CVE-2019-0708 and related vulnerabilities
Credential Stuffing: Using breached credentials from other sources

Sysmon Configuration for Terminal Services#

Core Sysmon Configuration#

1
<Sysmon schemaversion="4.82">
2
  <HashAlgorithms>md5,sha256,IMPHASH</HashAlgorithms>
3
  <CheckRevocation>false</CheckRevocation>
4
  <DnsLookup>false</DnsLookup>
5
  <ArchiveDirectory>SysmonArchive</ArchiveDirectory>
6

7
  <EventFiltering>
8
    <!-- Event ID 1: Process Creation -->
9
    <RuleGroup name="" groupRelation="or">
10
      <ProcessCreate onmatch="include">
11
        <!-- Terminal Services related processes -->
12
        <Image condition="contains">rdpclip.exe</Image>
13
        <Image condition="contains">tstheme.exe</Image>
14
        <Image condition="contains">dwm.exe</Image>
15
        <Image condition="contains">winlogon.exe</Image>
16
        <Image condition="contains">csrss.exe</Image>
17
        <Image condition="contains">rdpinit.exe</Image>
18
        <Image condition="contains">rdpshell.exe</Image>
19

20
        <!-- RDP Client processes -->
21
        <Image condition="contains">mstsc.exe</Image>
22
        <Image condition="contains">mstscax.dll</Image>
23

24
        <!-- Terminal Services utilities -->
25
        <Image condition="contains">tscon.exe</Image>
26
        <Image condition="contains">tsdiscon.exe</Image>
27
        <Image condition="contains">rwinsta.exe</Image>
28
        <Image condition="contains">qwinsta.exe</Image>
29
        <Image condition="contains">quser.exe</Image>
30
        <Image condition="contains">query.exe</Image>
31

32
        <!-- Remote access tools -->
33
        <Image condition="contains">teamviewer.exe</Image>
34
        <Image condition="contains">anydesk.exe</Image>
35
        <Image condition="contains">vnc</Image>
36
        <Image condition="contains">logmein</Image>
37

38
        <!-- Suspicious parent processes -->
39
        <ParentImage condition="contains">rdpclip.exe</ParentImage>
40
        <ParentImage condition="contains">winlogon.exe</ParentImage>
41

42
        <!-- Commands executed over RDP sessions -->
43
        <CommandLine condition="contains">powershell</CommandLine>
44
        <CommandLine condition="contains">cmd.exe</CommandLine>
45
        <CommandLine condition="contains">wmic</CommandLine>
46
        <CommandLine condition="contains">net user</CommandLine>
47
        <CommandLine condition="contains">net group</CommandLine>
48
        <CommandLine condition="contains">whoami</CommandLine>
49
        <CommandLine condition="contains">systeminfo</CommandLine>
50
      </ProcessCreate>
51
    </RuleGroup>
52

53
    <!-- Event ID 3: Network Connection -->
54
    <RuleGroup name="" groupRelation="or">
55
      <NetworkConnect onmatch="include">
56
        <!-- RDP Traffic (Port 3389) -->
57
        <DestinationPort condition="is">3389</DestinationPort>
58
        <SourcePort condition="is">3389</SourcePort>
59

60
        <!-- Alternative RDP Ports -->
61
        <DestinationPort condition="is">3390</DestinationPort>
62
        <DestinationPort condition="is">3391</DestinationPort>
63
        <DestinationPort condition="is">33890</DestinationPort>
64

65
        <!-- RDP-related processes -->
66
        <Image condition="contains">mstsc.exe</Image>
67
        <Image condition="contains">rdpclip.exe</Image>
68
        <Image condition="contains">tstheme.exe</Image>
69

70
        <!-- Terminal Services processes -->
71
        <Image condition="contains">svchost.exe</Image>
72
        <Image condition="contains">termsrv.dll</Image>
73

74
        <!-- Outbound connections from RDP sessions -->
75
        <User condition="contains">RDP-Tcp</User>
76
        <User condition="contains">Console</User>
77

78
        <!-- Suspicious network activity -->
79
        <DestinationHostname condition="contains">bit.ly</DestinationHostname>
80
        <DestinationHostname condition="contains">pastebin</DestinationHostname>
81
        <DestinationHostname condition="contains">github.com</DestinationHostname>
82
        <DestinationHostname condition="contains">githubusercontent</DestinationHostname>
83
      </NetworkConnect>
84
    </RuleGroup>
85

86
    <!-- Event ID 5: Process Terminated -->
87
    <RuleGroup name="" groupRelation="or">
88
      <ProcessTerminate onmatch="include">
89
        <!-- Terminal Services process termination -->
90
        <Image condition="contains">rdpclip.exe</Image>
91
        <Image condition="contains">tstheme.exe</Image>
92
        <Image condition="contains">dwm.exe</Image>
93

94
        <!-- RDP session cleanup -->
95
        <Image condition="contains">mstsc.exe</Image>
96
        <Image condition="contains">tsclient</Image>
97
      </ProcessTerminate>
98
    </RuleGroup>
99

100
    <!-- Event ID 7: Image/Library Loaded -->
101
    <RuleGroup name="" groupRelation="or">
102
      <ImageLoad onmatch="include">
103
        <!-- Terminal Services DLLs -->
104
        <ImageLoaded condition="contains">termsrv.dll</ImageLoaded>
105
        <ImageLoaded condition="contains">rdpcorekmts.dll</ImageLoaded>
106
        <ImageLoaded condition="contains">rdpcorets.dll</ImageLoaded>
107
        <ImageLoaded condition="contains">rdpcore.dll</ImageLoaded>
108
        <ImageLoaded condition="contains">mstscax.dll</ImageLoaded>
109
        <ImageLoaded condition="contains">tsclient.dll</ImageLoaded>
110

111
        <!-- RDP-related modules -->
112
        <ImageLoaded condition="contains">rdpdr.sys</ImageLoaded>
113
        <ImageLoaded condition="contains">rdpsnd.sys</ImageLoaded>
114
        <ImageLoaded condition="contains">rdpwd.sys</ImageLoaded>
115

116
        <!-- Clipboard redirection -->
117
        <ImageLoaded condition="contains">rdpclip.dll</ImageLoaded>
118
        <ImageLoaded condition="contains">cliprdr.dll</ImageLoaded>
119

120
        <!-- Drive redirection -->
121
        <ImageLoaded condition="contains">rdpdr.dll</ImageLoaded>
122
        <ImageLoaded condition="contains">tsclient.dll</ImageLoaded>
123
      </ImageLoad>
124
    </RuleGroup>
125

126
    <!-- Event ID 8: CreateRemoteThread -->
127
    <RuleGroup name="" groupRelation="or">
128
      <CreateRemoteThread onmatch="include">
129
        <!-- Injection into Terminal Services processes -->
130
        <TargetImage condition="contains">csrss.exe</TargetImage>
131
        <TargetImage condition="contains">winlogon.exe</TargetImage>
132
        <TargetImage condition="contains">rdpclip.exe</TargetImage>
133
        <TargetImage condition="contains">dwm.exe</TargetImage>
134

135
        <!-- RDP session injection -->
136
        <SourceImage condition="contains">mstsc.exe</SourceImage>
137
        <TargetImage condition="contains">explorer.exe</TargetImage>
138
      </CreateRemoteThread>
139
    </RuleGroup>
140

141
    <!-- Event ID 10: Process Access -->
142
    <RuleGroup name="" groupRelation="or">
143
      <ProcessAccess onmatch="include">
144
        <!-- Access to Terminal Services processes -->
145
        <TargetImage condition="contains">csrss.exe</TargetImage>
146
        <TargetImage condition="contains">winlogon.exe</TargetImage>
147
        <TargetImage condition="contains">rdpclip.exe</TargetImage>
148
        <TargetImage condition="contains">dwm.exe</TargetImage>
149
        <TargetImage condition="contains">lsass.exe</TargetImage>
150

151
        <!-- Credential dumping attempts -->
152
        <GrantedAccess>0x1010</GrantedAccess>
153
        <GrantedAccess>0x1410</GrantedAccess>
154
        <GrantedAccess>0x143a</GrantedAccess>
155

156
        <!-- RDP process access patterns -->
157
        <SourceImage condition="contains">powershell.exe</SourceImage>
158
        <SourceImage condition="contains">cmd.exe</SourceImage>
159
        <CallTrace condition="contains">UNKNOWN</CallTrace>
160
      </ProcessAccess>
161
    </RuleGroup>
162

163
    <!-- Event ID 11: File Created -->
164
    <RuleGroup name="" groupRelation="or">
165
      <FileCreate onmatch="include">
166
        <!-- RDP cache and temporary files -->
167
        <TargetFilename condition="contains">\Local Settings\Temporary Internet Files\</TargetFilename>
168
        <TargetFilename condition="contains">\Microsoft\Terminal Server Client\</TargetFilename>
169
        <TargetFilename condition="contains">\rdp_cache\</TargetFilename>
170
        <TargetFilename condition="contains">tsclient</TargetFilename>
171

172
        <!-- Clipboard cache -->
173
        <TargetFilename condition="contains">\rdpclip</TargetFilename>
174
        <TargetFilename condition="contains">\ClipboardCache</TargetFilename>
175

176
        <!-- RDP configuration files -->
177
        <TargetFilename condition="contains">.rdp</TargetFilename>
178
        <TargetFilename condition="contains">Default.rdp</TargetFilename>
179

180
        <!-- Suspicious file locations -->
181
        <TargetFilename condition="contains">\AppData\Local\Temp\</TargetFilename>
182
        <TargetFilename condition="contains">\Windows\Temp\</TargetFilename>
183
        <TargetFilename condition="contains">\ProgramData\</TargetFilename>
184

185
        <!-- Executable files from RDP sessions -->
186
        <TargetFilename condition="endswith">.exe</TargetFilename>
187
        <TargetFilename condition="endswith">.dll</TargetFilename>
188
        <TargetFilename condition="endswith">.bat</TargetFilename>
189
        <TargetFilename condition="endswith">.ps1</TargetFilename>
190
        <TargetFilename condition="endswith">.vbs</TargetFilename>
191
      </FileCreate>
192
    </RuleGroup>
193

194
    <!-- Event ID 12: Registry Event (Object create and delete) -->
195
    <RuleGroup name="" groupRelation="or">
196
      <RegistryEvent onmatch="include">
197
        <!-- Terminal Services registry keys -->
198
        <TargetObject condition="contains">SYSTEM\CurrentControlSet\Control\Terminal Server</TargetObject>
199
        <TargetObject condition="contains">SOFTWARE\Microsoft\Terminal Server Client</TargetObject>
200
        <TargetObject condition="contains">SYSTEM\CurrentControlSet\Services\TermService</TargetObject>
201

202
        <!-- RDP settings modifications -->
203
        <TargetObject condition="contains">fDenyTSConnections</TargetObject>
204
        <TargetObject condition="contains">UserAuthentication</TargetObject>
205
        <TargetObject condition="contains">SecurityLayer</TargetObject>
206
        <TargetObject condition="contains">PortNumber</TargetObject>
207

208
        <!-- Session configuration -->
209
        <TargetObject condition="contains">WinStations\RDP-Tcp</TargetObject>
210
        <TargetObject condition="contains">WinStations\Console</TargetObject>
211

212
        <!-- Clipboard and drive redirection -->
213
        <TargetObject condition="contains">fDisableClip</TargetObject>
214
        <TargetObject condition="contains">fDisableCdm</TargetObject>
215
        <TargetObject condition="contains">fDisableCam</TargetObject>
216

217
        <!-- Authentication settings -->
218
        <TargetObject condition="contains">HKLM\SYSTEM\CurrentControlSet\Control\Lsa</TargetObject>
219
        <TargetObject condition="contains">DisableRestrictedAdmin</TargetObject>
220
      </RegistryEvent>
221
    </RuleGroup>
222

223
    <!-- Event ID 13: Registry Value Set -->
224
    <RuleGroup name="" groupRelation="or">
225
      <RegistryEvent onmatch="include">
226
        <!-- Critical Terminal Services settings -->
227
        <TargetObject condition="contains">SYSTEM\CurrentControlSet\Control\Terminal Server\fDenyTSConnections</TargetObject>
228
        <TargetObject condition="contains">SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber</TargetObject>
229
        <TargetObject condition="contains">SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\UserAuthentication</TargetObject>
230

231
        <!-- Security layer modifications -->
232
        <TargetObject condition="contains">SecurityLayer</TargetObject>
233
        <TargetObject condition="contains">MinEncryptionLevel</TargetObject>
234

235
        <!-- Session timeout settings -->
236
        <TargetObject condition="contains">MaxConnectionTime</TargetObject>
237
        <TargetObject condition="contains">MaxDisconnectionTime</TargetObject>
238
        <TargetObject condition="contains">MaxIdleTime</TargetObject>
239
      </RegistryEvent>
240
    </RuleGroup>
241

242
    <!-- Event ID 15: File Create Stream Hash -->
243
    <RuleGroup name="" groupRelation="or">
244
      <FileCreateStreamHash onmatch="include">
245
        <!-- RDP-related alternate data streams -->
246
        <TargetFilename condition="contains">tsclient</TargetFilename>
247
        <TargetFilename condition="contains">rdpclip</TargetFilename>
248
        <TargetFilename condition="contains">.rdp:</TargetFilename>
249

250
        <!-- Suspicious ADS in RDP directories -->
251
        <TargetFilename condition="contains">\Terminal Server Client\</TargetFilename>
252
        <TargetFilename condition="contains">\Microsoft\Terminal Server Client\</TargetFilename>
253
      </FileCreateStreamHash>
254
    </RuleGroup>
255

256
    <!-- Event ID 17: Pipe Created -->
257
    <RuleGroup name="" groupRelation="or">
258
      <PipeEvent onmatch="include">
259
        <!-- Terminal Services named pipes -->
260
        <PipeName condition="contains">TermSrv</PipeName>
261
        <PipeName condition="contains">trkwks</PipeName>
262
        <PipeName condition="contains">Ctx_WinStation_API_service</PipeName>
263
        <PipeName condition="contains">ICA</PipeName>
264

265
        <!-- RDP session pipes -->
266
        <PipeName condition="contains">RDPClient</PipeName>
267
        <PipeName condition="contains">TSClient</PipeName>
268

269
        <!-- Clipboard pipes -->
270
        <PipeName condition="contains">cliprdr</PipeName>
271

272
        <!-- Suspicious pipe names -->
273
        <PipeName condition="contains">rdp</PipeName>
274
        <PipeName condition="contains">remote</PipeName>
275
      </PipeEvent>
276
    </RuleGroup>
277

278
    <!-- Event ID 18: Pipe Connected -->
279
    <RuleGroup name="" groupRelation="or">
280
      <PipeEvent onmatch="include">
281
        <!-- Connections to Terminal Services pipes -->
282
        <PipeName condition="contains">TermSrv</PipeName>
283
        <PipeName condition="contains">trkwks</PipeName>
284
        <PipeName condition="contains">Ctx_WinStation_API_service</PipeName>
285

286
        <!-- RDP client connections -->
287
        <PipeName condition="contains">RDPClient</PipeName>
288
        <PipeName condition="contains">cliprdr</PipeName>
289
      </PipeEvent>
290
    </RuleGroup>
291

292
    <!-- Event ID 22: DNS Query -->
293
    <RuleGroup name="" groupRelation="or">
294
      <DnsQuery onmatch="include">
295
        <!-- DNS queries from RDP processes -->
296
        <Image condition="contains">mstsc.exe</Image>
297
        <Image condition="contains">rdpclip.exe</Image>
298

299
        <!-- Suspicious domains from RDP sessions -->
300
        <QueryName condition="contains">bit.ly</QueryName>
301
        <QueryName condition="contains">pastebin</QueryName>
302
        <QueryName condition="contains">github.com</QueryName>
303
        <QueryName condition="contains">powershellgallery.com</QueryName>
304

305
        <!-- Dynamic DNS providers -->
306
        <QueryName condition="contains">dyndns</QueryName>
307
        <QueryName condition="contains">no-ip</QueryName>
308
        <QueryName condition="contains">ddns</QueryName>
309
      </DnsQuery>
310
    </RuleGroup>
311

312
    <!-- Event ID 25: Process Tampering -->
313
    <RuleGroup name="" groupRelation="or">
314
      <ProcessTampering onmatch="include">
315
        <!-- Tampering with Terminal Services processes -->
316
        <Image condition="contains">csrss.exe</Image>
317
        <Image condition="contains">winlogon.exe</Image>
318
        <Image condition="contains">rdpclip.exe</Image>
319
        <Image condition="contains">dwm.exe</Image>
320
        <Image condition="contains">lsass.exe</Image>
321
      </ProcessTampering>
322
    </RuleGroup>
323

324
    <!-- Event ID 26: File Delete -->
325
    <RuleGroup name="" groupRelation="or">
326
      <FileDelete onmatch="include">
327
        <!-- RDP cache cleanup -->
328
        <TargetFilename condition="contains">\Terminal Server Client\</TargetFilename>
329
        <TargetFilename condition="contains">tsclient</TargetFilename>
330
        <TargetFilename condition="contains">rdpclip</TargetFilename>
331

332
        <!-- Log file deletion -->
333
        <TargetFilename condition="contains">\Windows\System32\LogFiles\</TargetFilename>
334
        <TargetFilename condition="contains">\Security.evtx</TargetFilename>
335
        <TargetFilename condition="contains">\System.evtx</TargetFilename>
336

337
        <!-- RDP configuration files -->
338
        <TargetFilename condition="endswith">.rdp</TargetFilename>
339
      </FileDelete>
340
    </RuleGroup>
341

342
    <!-- Exclusions -->
343
    <RuleGroup name="" groupRelation="or">
344
      <ProcessCreate onmatch="exclude">
345
        <!-- Legitimate system processes -->
346
        <Image condition="is">C:\Windows\System32\csrss.exe</Image>
347
        <Image condition="is">C:\Windows\System32\winlogon.exe</Image>
348
        <ParentImage condition="is">C:\Windows\System32\services.exe</ParentImage>
349

350
        <!-- Known good software -->
351
        <Image condition="contains">C:\Program Files\</Image>
352
        <Image condition="contains">C:\Program Files (x86)\</Image>
353

354
        <!-- System updates -->
355
        <CommandLine condition="contains">Windows Update</CommandLine>
356
        <CommandLine condition="contains">TrustedInstaller</CommandLine>
357
      </ProcessCreate>
358
    </RuleGroup>
359
  </EventFiltering>
360
</Sysmon>

Advanced Detection Rules#

Suspicious RDP Activity Detection#

1
<!-- High-confidence RDP attack indicators -->
2
<RuleGroup name="RDP_Attack_Indicators" groupRelation="or">
3
  <ProcessCreate onmatch="include">
4
    <!-- Rare Terminal Services utilities -->
5
    <Image condition="contains">tscon.exe</Image>
6
    <Image condition="contains">tsdiscon.exe</Image>
7
    <Image condition="contains">rwinsta.exe</Image>
8
    <Image condition="contains">qwinsta.exe</Image>
9

10
    <!-- Session hijacking attempts -->
11
    <CommandLine condition="contains">tscon /dest:console</CommandLine>
12
    <CommandLine condition="contains">tscon /dest:rdp</CommandLine>
13
    <CommandLine condition="contains">rwinsta /server:</CommandLine>
14

15
    <!-- RDP tunnel creation -->
16
    <CommandLine condition="contains">portfwd</CommandLine>
17
    <CommandLine condition="contains">netsh interface portproxy</CommandLine>
18
    <CommandLine condition="contains">ssh -L 3389</CommandLine>
19

20
    <!-- Credential extraction from RDP -->
21
    <CommandLine condition="contains">sekurlsa::tspkg</CommandLine>
22
    <CommandLine condition="contains">sekurlsa::credman</CommandLine>
23
    <CommandLine condition="contains">lsadump::cache</CommandLine>
24
  </ProcessCreate>
25
</RuleGroup>
26

27
<!-- Lateral movement via RDP -->
28
<RuleGroup name="RDP_Lateral_Movement" groupRelation="or">
29
  <NetworkConnect onmatch="include">
30
    <!-- Rapid successive RDP connections -->
31
    <DestinationPort condition="is">3389</DestinationPort>
32
    <Image condition="contains">mstsc.exe</Image>
33

34
    <!-- RDP to multiple hosts -->
35
    <DestinationIp condition="contains">192.168.</DestinationIp>
36
    <DestinationIp condition="contains">10.</DestinationIp>
37
    <DestinationIp condition="contains">172.16.</DestinationIp>
38
  </NetworkConnect>
39
</RuleGroup>
40

41
<!-- RDP configuration tampering -->
42
<RuleGroup name="RDP_Configuration_Tampering" groupRelation="or">
43
  <RegistryEvent onmatch="include">
44
    <!-- Enabling RDP -->
45
    <TargetObject condition="contains">fDenyTSConnections</TargetObject>
46
    <Details condition="is">0x00000000</Details>
47

48
    <!-- Disabling NLA -->
49
    <TargetObject condition="contains">UserAuthentication</TargetObject>
50
    <Details condition="is">0x00000000</Details>
51

52
    <!-- Changing RDP port -->
53
    <TargetObject condition="contains">PortNumber</TargetObject>
54
    <Details condition="isnot">0x00000d3d</Details>
55

56
    <!-- Weakening security -->
57
    <TargetObject condition="contains">SecurityLayer</TargetObject>
58
    <Details condition="is">0x00000000</Details>
59
  </RegistryEvent>
60
</RuleGroup>

Persistence Detection#

1
<!-- RDP persistence mechanisms -->
2
<RuleGroup name="RDP_Persistence" groupRelation="or">
3
  <RegistryEvent onmatch="include">
4
    <!-- RDP service modifications -->
5
    <TargetObject condition="contains">SYSTEM\CurrentControlSet\Services\TermService</TargetObject>
6
    <TargetObject condition="contains">Start</TargetObject>
7
    <Details condition="is">0x00000002</Details>
8

9
    <!-- Sticky keys backdoor -->
10
    <TargetObject condition="contains">Image File Execution Options\sethc.exe</TargetObject>
11
    <TargetObject condition="contains">Debugger</TargetObject>
12

13
    <!-- Utilman backdoor -->
14
    <TargetObject condition="contains">Image File Execution Options\utilman.exe</TargetObject>
15
    <TargetObject condition="contains">Debugger</TargetObject>
16

17
    <!-- Magnifier backdoor -->
18
    <TargetObject condition="contains">Image File Execution Options\magnify.exe</TargetObject>
19
    <TargetObject condition="contains">Debugger</TargetObject>
20

21
    <!-- OSK backdoor -->
22
    <TargetObject condition="contains">Image File Execution Options\osk.exe</TargetObject>
23
    <TargetObject condition="contains">Debugger</TargetObject>
24
  </RegistryEvent>
25

26
  <FileCreate onmatch="include">
27
    <!-- Accessibility tool replacement -->
28
    <TargetFilename condition="is">C:\Windows\System32\sethc.exe</TargetFilename>
29
    <TargetFilename condition="is">C:\Windows\System32\utilman.exe</TargetFilename>
30
    <TargetFilename condition="is">C:\Windows\System32\magnify.exe</TargetFilename>
31
    <TargetFilename condition="is">C:\Windows\System32\osk.exe</TargetFilename>
32

33
    <!-- Backup accessibility tools -->
34
    <TargetFilename condition="contains">sethc.exe.backup</TargetFilename>
35
    <TargetFilename condition="contains">utilman.exe.backup</TargetFilename>
36
  </FileCreate>
37
</RuleGroup>

Detection Analytics and Queries#

PowerShell Detection Queries#

1
# Get-RDPConnections.ps1 - Analyze RDP connections from Sysmon logs
2

3
# Function to query Sysmon events for RDP activity
4
function Get-RDPConnections {
5
    param(
6
        [Parameter(Mandatory=$true)]
7
        [datetime]$StartTime,
8

9
        [Parameter(Mandatory=$true)]
10
        [datetime]$EndTime,
11

12
        [Parameter(Mandatory=$false)]
13
        [string]$ComputerName = $env:COMPUTERNAME
14
    )
15

16
    Write-Host "Analyzing RDP connections between $StartTime and $EndTime on $ComputerName" -ForegroundColor Green
17

18
    # Query for RDP network connections (Event ID 3)
19
    $rdpConnections = Get-WinEvent -FilterHashtable @{
20
        LogName = 'Microsoft-Windows-Sysmon/Operational'
21
        ID = 3
22
        StartTime = $StartTime
23
        EndTime = $EndTime
24
    } -ComputerName $ComputerName | Where-Object {
25
        $_.Message -match "DestinationPort: 3389|SourcePort: 3389" -or
26
        $_.Message -match "mstsc.exe|rdpclip.exe"
27
    }
28

29
    # Query for RDP process creation (Event ID 1)
30
    $rdpProcesses = Get-WinEvent -FilterHashtable @{
31
        LogName = 'Microsoft-Windows-Sysmon/Operational'
32
        ID = 1
33
        StartTime = $StartTime
34
        EndTime = $EndTime
35
    } -ComputerName $ComputerName | Where-Object {
36
        $_.Message -match "mstsc.exe|rdpclip.exe|tscon.exe|tsdiscon.exe|qwinsta.exe"
37
    }
38

39
    # Query for RDP registry modifications (Event ID 13)
40
    $rdpRegistry = Get-WinEvent -FilterHashtable @{
41
        LogName = 'Microsoft-Windows-Sysmon/Operational'
42
        ID = 13
43
        StartTime = $StartTime
44
        EndTime = $EndTime
45
    } -ComputerName $ComputerName | Where-Object {
46
        $_.Message -match "Terminal Server|fDenyTSConnections|PortNumber"
47
    }
48

49
    # Analyze and format results
50
    $results = @{
51
        NetworkConnections = @()
52
        ProcessActivity = @()
53
        RegistryChanges = @()
54
        SuspiciousActivity = @()
55
    }
56

57
    # Process network connections
58
    foreach ($connection in $rdpConnections) {
59
        $xml = [xml]$connection.ToXml()
60
        $eventData = $xml.Event.EventData.Data
61

62
        $connInfo = @{
63
            TimeCreated = $connection.TimeCreated
64
            ProcessId = ($eventData | Where-Object {$_.Name -eq 'ProcessId'}).'#text'
65
            Image = ($eventData | Where-Object {$_.Name -eq 'Image'}).'#text'
66
            SourceIp = ($eventData | Where-Object {$_.Name -eq 'SourceIp'}).'#text'
67
            DestinationIp = ($eventData | Where-Object {$_.Name -eq 'DestinationIp'}).'#text'
68
            SourcePort = ($eventData | Where-Object {$_.Name -eq 'SourcePort'}).'#text'
69
            DestinationPort = ($eventData | Where-Object {$_.Name -eq 'DestinationPort'}).'#text'
70
            User = ($eventData | Where-Object {$_.Name -eq 'User'}).'#text'
71
        }
72

73
        $results.NetworkConnections += $connInfo
74
    }
75

76
    # Process RDP processes
77
    foreach ($process in $rdpProcesses) {
78
        $xml = [xml]$process.ToXml()
79
        $eventData = $xml.Event.EventData.Data
80

81
        $processInfo = @{
82
            TimeCreated = $process.TimeCreated
83
            ProcessId = ($eventData | Where-Object {$_.Name -eq 'ProcessId'}).'#text'
84
            Image = ($eventData | Where-Object {$_.Name -eq 'Image'}).'#text'
85
            CommandLine = ($eventData | Where-Object {$_.Name -eq 'CommandLine'}).'#text'
86
            User = ($eventData | Where-Object {$_.Name -eq 'User'}).'#text'
87
            ParentImage = ($eventData | Where-Object {$_.Name -eq 'ParentImage'}).'#text'
88
            ParentCommandLine = ($eventData | Where-Object {$_.Name -eq 'ParentCommandLine'}).'#text'
89
        }
90

91
        $results.ProcessActivity += $processInfo
92

93
        # Flag suspicious activities
94
        if ($processInfo.CommandLine -match "tscon|tsdiscon|rwinsta" -or
95
            $processInfo.Image -match "tscon.exe|tsdiscon.exe|rwinsta.exe") {
96
            $results.SuspiciousActivity += @{
97
                Type = "Session Management"
98
                TimeCreated = $process.TimeCreated
99
                Details = $processInfo
100
            }
101
        }
102
    }
103

104
    # Process registry changes
105
    foreach ($regChange in $rdpRegistry) {
106
        $xml = [xml]$regChange.ToXml()
107
        $eventData = $xml.Event.EventData.Data
108

109
        $regInfo = @{
110
            TimeCreated = $regChange.TimeCreated
111
            ProcessId = ($eventData | Where-Object {$_.Name -eq 'ProcessId'}).'#text'
112
            Image = ($eventData | Where-Object {$_.Name -eq 'Image'}).'#text'
113
            TargetObject = ($eventData | Where-Object {$_.Name -eq 'TargetObject'}).'#text'
114
            Details = ($eventData | Where-Object {$_.Name -eq 'Details'}).'#text'
115
            User = ($eventData | Where-Object {$_.Name -eq 'User'}).'#text'
116
        }
117

118
        $results.RegistryChanges += $regInfo
119

120
        # Flag suspicious registry changes
121
        if ($regInfo.TargetObject -match "fDenyTSConnections" -and $regInfo.Details -eq "DWORD (0x00000000)") {
122
            $results.SuspiciousActivity += @{
123
                Type = "RDP Enabled"
124
                TimeCreated = $regChange.TimeCreated
125
                Details = $regInfo
126
            }
127
        } elseif ($regInfo.TargetObject -match "PortNumber" -and $regInfo.Details -ne "DWORD (0x00000d3d)") {
128
            $results.SuspiciousActivity += @{
129
                Type = "RDP Port Changed"
130
                TimeCreated = $regChange.TimeCreated
131
                Details = $regInfo
132
            }
133
        }
134
    }
135

136
    return $results
137
}
138

139
# Function to detect RDP brute force attempts
140
function Get-RDPBruteForce {
141
    param(
142
        [Parameter(Mandatory=$true)]
143
        [datetime]$StartTime,
144

145
        [Parameter(Mandatory=$true)]
146
        [datetime]$EndTime,
147

148
        [Parameter(Mandatory=$false)]
149
        [int]$ThresholdCount = 10,
150

151
        [Parameter(Mandatory=$false)]
152
        [string]$ComputerName = $env:COMPUTERNAME
153
    )
154

155
    # Get RDP connection attempts
156
    $connections = Get-WinEvent -FilterHashtable @{
157
        LogName = 'Microsoft-Windows-Sysmon/Operational'
158
        ID = 3
159
        StartTime = $StartTime
160
        EndTime = $EndTime
161
    } -ComputerName $ComputerName | Where-Object {
162
        $_.Message -match "DestinationPort: 3389"
163
    }
164

165
    # Group by source IP and count
166
    $connectionsByIP = $connections | ForEach-Object {
167
        $xml = [xml]$_.ToXml()
168
        $eventData = $xml.Event.EventData.Data
169
        $sourceIp = ($eventData | Where-Object {$_.Name -eq 'SourceIp'}).'#text'
170

171
        [PSCustomObject]@{
172
            TimeCreated = $_.TimeCreated
173
            SourceIp = $sourceIp
174
            DestinationIp = ($eventData | Where-Object {$_.Name -eq 'DestinationIp'}).'#text'
175
            ProcessId = ($eventData | Where-Object {$_.Name -eq 'ProcessId'}).'#text'
176
        }
177
    } | Group-Object SourceIp
178

179
    # Identify potential brute force attacks
180
    $bruteForceAttempts = $connectionsByIP | Where-Object {
181
        $_.Count -ge $ThresholdCount
182
    } | ForEach-Object {
183
        [PSCustomObject]@{
184
            SourceIP = $_.Name
185
            ConnectionCount = $_.Count
186
            FirstAttempt = ($_.Group | Sort-Object TimeCreated)[0].TimeCreated
187
            LastAttempt = ($_.Group | Sort-Object TimeCreated)[-1].TimeCreated
188
            UniqueDestinations = ($_.Group | Select-Object -Unique DestinationIp).Count
189
            TimeSpan = (($_.Group | Sort-Object TimeCreated)[-1].TimeCreated - ($_.Group | Sort-Object TimeCreated)[0].TimeCreated).TotalMinutes
190
        }
191
    }
192

193
    return $bruteForceAttempts
194
}
195

196
# Function to detect RDP lateral movement
197
function Get-RDPLateralMovement {
198
    param(
199
        [Parameter(Mandatory=$true)]
200
        [datetime]$StartTime,
201

202
        [Parameter(Mandatory=$true)]
203
        [datetime]$EndTime,
204

205
        [Parameter(Mandatory=$false)]
206
        [string]$ComputerName = $env:COMPUTERNAME
207
    )
208

209
    # Get outbound RDP connections
210
    $outboundConnections = Get-WinEvent -FilterHashtable @{
211
        LogName = 'Microsoft-Windows-Sysmon/Operational'
212
        ID = 3
213
        StartTime = $StartTime
214
        EndTime = $EndTime
215
    } -ComputerName $ComputerName | Where-Object {
216
        $_.Message -match "DestinationPort: 3389" -and
217
        $_.Message -match "mstsc.exe"
218
    }
219

220
    # Analyze for patterns indicating lateral movement
221
    $lateralMovement = $outboundConnections | ForEach-Object {
222
        $xml = [xml]$_.ToXml()
223
        $eventData = $xml.Event.EventData.Data
224

225
        [PSCustomObject]@{
226
            TimeCreated = $_.TimeCreated
227
            SourceIp = ($eventData | Where-Object {$_.Name -eq 'SourceIp'}).'#text'
228
            DestinationIp = ($eventData | Where-Object {$_.Name -eq 'DestinationIp'}).'#text'
229
            User = ($eventData | Where-Object {$_.Name -eq 'User'}).'#text'
230
            ProcessId = ($eventData | Where-Object {$_.Name -eq 'ProcessId'}).'#text'
231
            Image = ($eventData | Where-Object {$_.Name -eq 'Image'}).'#text'
232
        }
233
    } | Group-Object User | Where-Object {
234
        # Multiple destinations indicate potential lateral movement
235
        ($_.Group | Select-Object -Unique DestinationIp).Count -gt 2
236
    }
237

238
    return $lateralMovement
239
}
240

241
# Usage examples
242
$results = Get-RDPConnections -StartTime (Get-Date).AddHours(-24) -EndTime (Get-Date)
243
$bruteForce = Get-RDPBruteForce -StartTime (Get-Date).AddHours(-24) -EndTime (Get-Date) -ThresholdCount 5
244
$lateralMovement = Get-RDPLateralMovement -StartTime (Get-Date).AddHours(-24) -EndTime (Get-Date)
245

246
# Display results
247
Write-Host "=== RDP Activity Summary ===" -ForegroundColor Yellow
248
Write-Host "Network Connections: $($results.NetworkConnections.Count)" -ForegroundColor Cyan
249
Write-Host "Process Activity: $($results.ProcessActivity.Count)" -ForegroundColor Cyan
250
Write-Host "Registry Changes: $($results.RegistryChanges.Count)" -ForegroundColor Cyan
251
Write-Host "Suspicious Activities: $($results.SuspiciousActivity.Count)" -ForegroundColor Red
252

253
if ($bruteForce.Count -gt 0) {
254
    Write-Host "=== Potential Brute Force Attacks ===" -ForegroundColor Red
255
    $bruteForce | Format-Table -AutoSize
256
}
257

258
if ($lateralMovement.Count -gt 0) {
259
    Write-Host "=== Potential Lateral Movement ===" -ForegroundColor Red
260
    $lateralMovement | Format-Table -AutoSize
261
}

Elasticsearch/Splunk Queries#

1
-- Elasticsearch query for RDP activity
2
GET sysmon-*/_search
3
{
4
  "query": {
5
    "bool": {
6
      "must": [
7
        {
8
          "range": {
9
            "@timestamp": {
10
              "gte": "now-24h"
11
            }
12
          }
13
        },
14
        {
15
          "bool": {
16
            "should": [
17
              {
18
                "match": {
19
                  "event.code": "3"
20
                }
21
              },
22
              {
23
                "match": {
24
                  "event.code": "1"
25
                }
26
              }
27
            ]
28
          }
29
        },
30
        {
31
          "bool": {
32
            "should": [
33
              {
34
                "match": {
35
                  "winlog.event_data.DestinationPort": "3389"
36
                }
37
              },
38
              {
39
                "match": {
40
                  "winlog.event_data.Image": "*mstsc.exe"
41
                }
42
              },
43
              {
44
                "match": {
45
                  "winlog.event_data.Image": "*rdpclip.exe"
46
                }
47
              }
48
            ]
49
          }
50
        }
51
      ]
52
    }
53
  },
54
  "aggs": {
55
    "rdp_activity_by_host": {
56
      "terms": {
57
        "field": "host.name",
58
        "size": 50
59
      }
60
    },
61
    "rdp_connections_by_ip": {
62
      "terms": {
63
        "field": "winlog.event_data.SourceIp",
64
        "size": 100
65
      }
66
    }
67
  }
68
}
69

70
-- Splunk query for RDP brute force detection
71
index=sysmon EventCode=3 DestinationPort=3389
72
| eval src_ip=SourceIp, dest_ip=DestinationIp
73
| stats count as connection_attempts, earliest(_time) as first_attempt, latest(_time) as last_attempt by src_ip, dest_ip
74
| where connection_attempts > 10
75
| eval duration_minutes=round((last_attempt-first_attempt)/60,2)
76
| sort - connection_attempts
77
| table src_ip, dest_ip, connection_attempts, first_attempt, last_attempt, duration_minutes
78

79
-- RDP lateral movement detection
80
index=sysmon EventCode=3 DestinationPort=3389 Image="*mstsc.exe"
81
| eval user=User, dest_ip=DestinationIp
82
| stats dc(dest_ip) as unique_destinations, values(dest_ip) as destinations by user
83
| where unique_destinations > 2
84
| sort - unique_destinations

Threat Hunting Playbooks#

RDP Threat Hunting Methodology#

1
# RDP-ThreatHunt.ps1 - Comprehensive RDP threat hunting
2

3
class RDPThreatHunter {
4
    [string]$ComputerName
5
    [datetime]$StartTime
6
    [datetime]$EndTime
7
    [hashtable]$Results
8

9
    RDPThreatHunter([string]$computerName, [datetime]$startTime, [datetime]$endTime) {
10
        $this.ComputerName = $computerName
11
        $this.StartTime = $startTime
12
        $this.EndTime = $endTime
13
        $this.Results = @{
14
            Indicators = @()
15
            Timeline = @()
16
            IOCs = @()
17
            Recommendations = @()
18
        }
19
    }
20

21
    # Hunt for RDP configuration changes
22
    [void]HuntConfigurationChanges() {
23
        Write-Host "[*] Hunting for RDP configuration changes..." -ForegroundColor Yellow
24

25
        $configChanges = Get-WinEvent -FilterHashtable @{
26
            LogName = 'Microsoft-Windows-Sysmon/Operational'
27
            ID = 13
28
            StartTime = $this.StartTime
29
            EndTime = $this.EndTime
30
        } -ComputerName $this.ComputerName | Where-Object {
31
            $_.Message -match "Terminal Server|fDenyTSConnections|PortNumber|UserAuthentication|SecurityLayer"
32
        }
33

34
        foreach ($change in $configChanges) {
35
            $xml = [xml]$change.ToXml()
36
            $eventData = $xml.Event.EventData.Data
37

38
            $indicator = @{
39
                Type = "Configuration Change"
40
                Severity = "Medium"
41
                TimeCreated = $change.TimeCreated
42
                ProcessId = ($eventData | Where-Object {$_.Name -eq 'ProcessId'}).'#text'
43
                Image = ($eventData | Where-Object {$_.Name -eq 'Image'}).'#text'
44
                TargetObject = ($eventData | Where-Object {$_.Name -eq 'TargetObject'}).'#text'
45
                Details = ($eventData | Where-Object {$_.Name -eq 'Details'}).'#text'
46
                User = ($eventData | Where-Object {$_.Name -eq 'User'}).'#text'
47
            }
48

49
            # Assess severity
50
            if ($indicator.TargetObject -match "fDenyTSConnections" -and $indicator.Details -match "0x00000000") {
51
                $indicator.Severity = "High"
52
                $indicator.Description = "RDP was enabled on the system"
53
            } elseif ($indicator.TargetObject -match "PortNumber" -and $indicator.Details -notmatch "0x00000d3d") {
54
                $indicator.Severity = "High"
55
                $indicator.Description = "RDP port was changed from default"
56
            } elseif ($indicator.TargetObject -match "UserAuthentication" -and $indicator.Details -match "0x00000000") {
57
                $indicator.Severity = "High"
58
                $indicator.Description = "NLA was disabled"
59
            }
60

61
            $this.Results.Indicators += $indicator
62
            $this.Results.Timeline += $indicator
63
        }
64
    }
65

66
    # Hunt for RDP persistence mechanisms
67
    [void]HuntPersistence() {
68
        Write-Host "[*] Hunting for RDP persistence mechanisms..." -ForegroundColor Yellow
69

70
        # Check for accessibility tool backdoors
71
        $accessibilityBackdoors = Get-WinEvent -FilterHashtable @{
72
            LogName = 'Microsoft-Windows-Sysmon/Operational'
73
            ID = 13
74
            StartTime = $this.StartTime
75
            EndTime = $this.EndTime
76
        } -ComputerName $this.ComputerName | Where-Object {
77
            $_.Message -match "Image File Execution Options\\(sethc|utilman|magnify|osk)\.exe"
78
        }
79

80
        foreach ($backdoor in $accessibilityBackdoors) {
81
            $xml = [xml]$backdoor.ToXml()
82
            $eventData = $xml.Event.EventData.Data
83

84
            $indicator = @{
85
                Type = "Persistence"
86
                Severity = "Critical"
87
                TimeCreated = $backdoor.TimeCreated
88
                Description = "Accessibility tool backdoor detected"
89
                TargetObject = ($eventData | Where-Object {$_.Name -eq 'TargetObject'}).'#text'
90
                Details = ($eventData | Where-Object {$_.Name -eq 'Details'}).'#text'
91
                Image = ($eventData | Where-Object {$_.Name -eq 'Image'}).'#text'
92
                User = ($eventData | Where-Object {$_.Name -eq 'User'}).'#text'
93
            }
94

95
            $this.Results.Indicators += $indicator
96
            $this.Results.Timeline += $indicator
97
        }
98

99
        # Check for file replacements
100
        $fileReplacements = Get-WinEvent -FilterHashtable @{
101
            LogName = 'Microsoft-Windows-Sysmon/Operational'
102
            ID = 11
103
            StartTime = $this.StartTime
104
            EndTime = $this.EndTime
105
        } -ComputerName $this.ComputerName | Where-Object {
106
            $_.Message -match "\\System32\\(sethc|utilman|magnify|osk)\.exe"
107
        }
108

109
        foreach ($replacement in $fileReplacements) {
110
            $xml = [xml]$replacement.ToXml()
111
            $eventData = $xml.Event.EventData.Data
112

113
            $indicator = @{
114
                Type = "Persistence"
115
                Severity = "Critical"
116
                TimeCreated = $replacement.TimeCreated
117
                Description = "Accessibility tool file replacement"
118
                TargetFilename = ($eventData | Where-Object {$_.Name -eq 'TargetFilename'}).'#text'
119
                Image = ($eventData | Where-Object {$_.Name -eq 'Image'}).'#text'
120
                User = ($eventData | Where-Object {$_.Name -eq 'User'}).'#text'
121
            }
122

123
            $this.Results.Indicators += $indicator
124
            $this.Results.Timeline += $indicator
125
        }
126
    }
127

128
    # Hunt for session hijacking
129
    [void]HuntSessionHijacking() {
130
        Write-Host "[*] Hunting for session hijacking attempts..." -ForegroundColor Yellow
131

132
        $sessionCommands = Get-WinEvent -FilterHashtable @{
133
            LogName = 'Microsoft-Windows-Sysmon/Operational'
134
            ID = 1
135
            StartTime = $this.StartTime
136
            EndTime = $this.EndTime
137
        } -ComputerName $this.ComputerName | Where-Object {
138
            $_.Message -match "tscon\.exe|tsdiscon\.exe|rwinsta\.exe" -or
139
            $_.Message -match "tscon /dest:|tsdiscon /server:|rwinsta /server:"
140
        }
141

142
        foreach ($command in $sessionCommands) {
143
            $xml = [xml]$command.ToXml()
144
            $eventData = $xml.Event.EventData.Data
145

146
            $commandLine = ($eventData | Where-Object {$_.Name -eq 'CommandLine'}).'#text'
147
            $severity = "High"
148

149
            # Increase severity for specific patterns
150
            if ($commandLine -match "tscon.*console|tscon.*rdp") {
151
                $severity = "Critical"
152
            }
153

154
            $indicator = @{
155
                Type = "Session Hijacking"
156
                Severity = $severity
157
                TimeCreated = $command.TimeCreated
158
                Description = "Terminal Services session manipulation"
159
                CommandLine = $commandLine
160
                Image = ($eventData | Where-Object {$_.Name -eq 'Image'}).'#text'
161
                User = ($eventData | Where-Object {$_.Name -eq 'User'}).'#text'
162
                ParentImage = ($eventData | Where-Object {$_.Name -eq 'ParentImage'}).'#text'
163
            }
164

165
            $this.Results.Indicators += $indicator
166
            $this.Results.Timeline += $indicator
167
        }
168
    }
169

170
    # Hunt for credential dumping
171
    [void]HuntCredentialDumping() {
172
        Write-Host "[*] Hunting for credential dumping from RDP sessions..." -ForegroundColor Yellow
173

174
        # Look for process access to LSASS from RDP sessions
175
        $lsassAccess = Get-WinEvent -FilterHashtable @{
176
            LogName = 'Microsoft-Windows-Sysmon/Operational'
177
            ID = 10
178
            StartTime = $this.StartTime
179
            EndTime = $this.EndTime
180
        } -ComputerName $this.ComputerName | Where-Object {
181
            $_.Message -match "lsass\.exe" -and
182
            ($_.Message -match "0x1010|0x1410|0x143a" -or
183
             $_.Message -match "rdpclip\.exe|mstsc\.exe")
184
        }
185

186
        foreach ($access in $lsassAccess) {
187
            $xml = [xml]$access.ToXml()
188
            $eventData = $xml.Event.EventData.Data
189

190
            $indicator = @{
191
                Type = "Credential Dumping"
192
                Severity = "Critical"
193
                TimeCreated = $access.TimeCreated
194
                Description = "Suspicious LSASS access from RDP session"
195
                SourceImage = ($eventData | Where-Object {$_.Name -eq 'SourceImage'}).'#text'
196
                TargetImage = ($eventData | Where-Object {$_.Name -eq 'TargetImage'}).'#text'
197
                GrantedAccess = ($eventData | Where-Object {$_.Name -eq 'GrantedAccess'}).'#text'
198
                CallTrace = ($eventData | Where-Object {$_.Name -eq 'CallTrace'}).'#text'
199
            }
200

201
            $this.Results.Indicators += $indicator
202
            $this.Results.Timeline += $indicator
203
        }
204

205
        # Look for common credential dumping tools
206
        $credDumpingTools = Get-WinEvent -FilterHashtable @{
207
            LogName = 'Microsoft-Windows-Sysmon/Operational'
208
            ID = 1
209
            StartTime = $this.StartTime
210
            EndTime = $this.EndTime
211
        } -ComputerName $this.ComputerName | Where-Object {
212
            $_.Message -match "mimikatz|sekurlsa|procdump|comsvcs\.dll" -or
213
            $_.Message -match "lsadump|logonpasswords|wdigest"
214
        }
215

216
        foreach ($tool in $credDumpingTools) {
217
            $xml = [xml]$tool.ToXml()
218
            $eventData = $xml.Event.EventData.Data
219

220
            $indicator = @{
221
                Type = "Credential Dumping"
222
                Severity = "Critical"
223
                TimeCreated = $tool.TimeCreated
224
                Description = "Credential dumping tool execution"
225
                CommandLine = ($eventData | Where-Object {$_.Name -eq 'CommandLine'}).'#text'
226
                Image = ($eventData | Where-Object {$_.Name -eq 'Image'}).'#text'
227
                User = ($eventData | Where-Object {$_.Name -eq 'User'}).'#text'
228
            }
229

230
            $this.Results.Indicators += $indicator
231
            $this.Results.Timeline += $indicator
232
        }
233
    }
234

235
    # Hunt for RDP tunneling
236
    [void]HuntRDPTunneling() {
237
        Write-Host "[*] Hunting for RDP tunneling activities..." -ForegroundColor Yellow
238

239
        $tunnelingCommands = Get-WinEvent -FilterHashtable @{
240
            LogName = 'Microsoft-Windows-Sysmon/Operational'
241
            ID = 1
242
            StartTime = $this.StartTime
243
            EndTime = $this.EndTime
244
        } -ComputerName $this.ComputerName | Where-Object {
245
            $_.Message -match "portfwd|netsh.*portproxy|ssh.*-L.*3389|plink.*-L.*3389" -or
246
            $_.Message -match "chisel|ngrok|frp|localtunnel"
247
        }
248

249
        foreach ($command in $tunnelingCommands) {
250
            $xml = [xml]$command.ToXml()
251
            $eventData = $xml.Event.EventData.Data
252

253
            $indicator = @{
254
                Type = "RDP Tunneling"
255
                Severity = "High"
256
                TimeCreated = $command.TimeCreated
257
                Description = "RDP tunneling or port forwarding"
258
                CommandLine = ($eventData | Where-Object {$_.Name -eq 'CommandLine'}).'#text'
259
                Image = ($eventData | Where-Object {$_.Name -eq 'Image'}).'#text'
260
                User = ($eventData | Where-Object {$_.Name -eq 'User'}).'#text'
261
            }
262

263
            $this.Results.Indicators += $indicator
264
            $this.Results.Timeline += $indicator
265
        }
266

267
        # Look for suspicious network connections
268
        $suspiciousConnections = Get-WinEvent -FilterHashtable @{
269
            LogName = 'Microsoft-Windows-Sysmon/Operational'
270
            ID = 3
271
            StartTime = $this.StartTime
272
            EndTime = $this.EndTime
273
        } -ComputerName $this.ComputerName | Where-Object {
274
            ($_.Message -match "DestinationPort: 22|DestinationPort: 443|DestinationPort: 80" -and
275
             $_.Message -match "ssh\.exe|plink\.exe|chisel\.exe|ngrok\.exe") -or
276
            $_.Message -match "DestinationPort: 3389.*DestinationIp: 127\.0\.0\.1"
277
        }
278

279
        foreach ($connection in $suspiciousConnections) {
280
            $xml = [xml]$connection.ToXml()
281
            $eventData = $xml.Event.EventData.Data
282

283
            $indicator = @{
284
                Type = "Suspicious Network"
285
                Severity = "Medium"
286
                TimeCreated = $connection.TimeCreated
287
                Description = "Potential tunneling network connection"
288
                Image = ($eventData | Where-Object {$_.Name -eq 'Image'}).'#text'
289
                DestinationIp = ($eventData | Where-Object {$_.Name -eq 'DestinationIp'}).'#text'
290
                DestinationPort = ($eventData | Where-Object {$_.Name -eq 'DestinationPort'}).'#text'
291
                User = ($eventData | Where-Object {$_.Name -eq 'User'}).'#text'
292
            }
293

294
            $this.Results.Indicators += $indicator
295
            $this.Results.Timeline += $indicator
296
        }
297
    }
298

299
    # Generate IOCs from findings
300
    [void]GenerateIOCs() {
301
        Write-Host "[*] Generating IOCs from hunt results..." -ForegroundColor Yellow
302

303
        foreach ($indicator in $this.Results.Indicators) {
304
            switch ($indicator.Type) {
305
                "Configuration Change" {
306
                    if ($indicator.TargetObject) {
307
                        $this.Results.IOCs += @{
308
                            Type = "Registry Key"
309
                            Value = $indicator.TargetObject
310
                            Context = $indicator.Description
311
                        }
312
                    }
313
                }
314
                "Persistence" {
315
                    if ($indicator.TargetFilename) {
316
                        $this.Results.IOCs += @{
317
                            Type = "File Path"
318
                            Value = $indicator.TargetFilename
319
                            Context = $indicator.Description
320
                        }
321
                    }
322
                }
323
                "Credential Dumping" {
324
                    if ($indicator.CommandLine) {
325
                        $this.Results.IOCs += @{
326
                            Type = "Command Line"
327
                            Value = $indicator.CommandLine
328
                            Context = $indicator.Description
329
                        }
330
                    }
331
                }
332
                "RDP Tunneling" {
333
                    if ($indicator.Image) {
334
                        $this.Results.IOCs += @{
335
                            Type = "Process"
336
                            Value = $indicator.Image
337
                            Context = $indicator.Description
338
                        }
339
                    }
340
                }
341
            }
342
        }
343

344
        # Deduplicate IOCs
345
        $this.Results.IOCs = $this.Results.IOCs | Sort-Object Type, Value -Unique
346
    }
347

348
    # Generate recommendations
349
    [void]GenerateRecommendations() {
350
        Write-Host "[*] Generating security recommendations..." -ForegroundColor Yellow
351

352
        $configChanges = $this.Results.Indicators | Where-Object {$_.Type -eq "Configuration Change"}
353
        $persistence = $this.Results.Indicators | Where-Object {$_.Type -eq "Persistence"}
354
        $hijacking = $this.Results.Indicators | Where-Object {$_.Type -eq "Session Hijacking"}
355

356
        if ($configChanges.Count -gt 0) {
357
            $this.Results.Recommendations += "Review and audit RDP configuration changes"
358
            $this.Results.Recommendations += "Implement change monitoring for Terminal Services settings"
359
            $this.Results.Recommendations += "Consider disabling RDP if not required"
360
        }
361

362
        if ($persistence.Count -gt 0) {
363
            $this.Results.Recommendations += "Immediately investigate accessibility tool modifications"
364
            $this.Results.Recommendations += "Implement file integrity monitoring for system utilities"
365
            $this.Results.Recommendations += "Review logon events for suspicious authentication patterns"
366
        }
367

368
        if ($hijacking.Count -gt 0) {
369
            $this.Results.Recommendations += "Investigate session management activities"
370
            $this.Results.Recommendations += "Review user privileges and session access"
371
            $this.Results.Recommendations += "Consider implementing session recording"
372
        }
373

374
        # General recommendations
375
        $this.Results.Recommendations += "Enable Network Level Authentication (NLA)"
376
        $this.Results.Recommendations += "Implement strong password policies"
377
        $this.Results.Recommendations += "Use MFA for RDP access"
378
        $this.Results.Recommendations += "Regularly rotate service accounts"
379
        $this.Results.Recommendations += "Monitor for lateral movement patterns"
380
    }
381

382
    # Execute comprehensive hunt
383
    [hashtable]ExecuteHunt() {
384
        Write-Host "=== RDP Threat Hunt Started ===" -ForegroundColor Green
385
        Write-Host "Computer: $($this.ComputerName)" -ForegroundColor Cyan
386
        Write-Host "Time Range: $($this.StartTime) to $($this.EndTime)" -ForegroundColor Cyan
387

388
        $this.HuntConfigurationChanges()
389
        $this.HuntPersistence()
390
        $this.HuntSessionHijacking()
391
        $this.HuntCredentialDumping()
392
        $this.HuntRDPTunneling()
393
        $this.GenerateIOCs()
394
        $this.GenerateRecommendations()
395

396
        # Sort timeline chronologically
397
        $this.Results.Timeline = $this.Results.Timeline | Sort-Object TimeCreated
398

399
        Write-Host "=== RDP Threat Hunt Completed ===" -ForegroundColor Green
400
        Write-Host "Total Indicators: $($this.Results.Indicators.Count)" -ForegroundColor Yellow
401
        Write-Host "Critical: $(($this.Results.Indicators | Where-Object {$_.Severity -eq 'Critical'}).Count)" -ForegroundColor Red
402
        Write-Host "High: $(($this.Results.Indicators | Where-Object {$_.Severity -eq 'High'}).Count)" -ForegroundColor Red
403
        Write-Host "Medium: $(($this.Results.Indicators | Where-Object {$_.Severity -eq 'Medium'}).Count)" -ForegroundColor Yellow
404

405
        return $this.Results
406
    }
407
}
408

409
# Usage example
410
$hunter = [RDPThreatHunter]::new($env:COMPUTERNAME, (Get-Date).AddDays(-7), (Get-Date))
411
$huntResults = $hunter.ExecuteHunt()
412

413
# Display critical findings
414
$criticalFindings = $huntResults.Indicators | Where-Object {$_.Severity -eq "Critical"}
415
if ($criticalFindings.Count -gt 0) {
416
    Write-Host "=== CRITICAL FINDINGS ===" -ForegroundColor Red
417
    $criticalFindings | Format-Table TimeCreated, Type, Description, User -AutoSize
418
}
419

420
# Display IOCs
421
if ($huntResults.IOCs.Count -gt 0) {
422
    Write-Host "=== GENERATED IOCs ===" -ForegroundColor Yellow
423
    $huntResults.IOCs | Format-Table Type, Value, Context -AutoSize
424
}
425

426
# Display recommendations
427
Write-Host "=== RECOMMENDATIONS ===" -ForegroundColor Cyan
428
$huntResults.Recommendations | ForEach-Object { Write-Host "• $_" -ForegroundColor White }

Incident Response Procedures#

RDP Incident Response Workflow#

1
# RDP-IncidentResponse.ps1 - Automated incident response for RDP attacks
2

3
class RDPIncidentHandler {
4
    [string]$IncidentId
5
    [string]$ComputerName
6
    [datetime]$IncidentStart
7
    [hashtable]$Evidence
8
    [array]$Actions
9

10
    RDPIncidentHandler([string]$incidentId, [string]$computerName, [datetime]$incidentStart) {
11
        $this.IncidentId = $incidentId
12
        $this.ComputerName = $computerName
13
        $this.IncidentStart = $incidentStart
14
        $this.Evidence = @{
15
            ProcessArtifacts = @()
16
            NetworkArtifacts = @()
17
            FileArtifacts = @()
18
            RegistryArtifacts = @()
19
            MemoryArtifacts = @()
20
        }
21
        $this.Actions = @()
22
    }
23

24
    # Initial triage and containment
25
    [void]InitialTriage() {
26
        Write-Host "[!] Initiating RDP incident triage for $($this.IncidentId)" -ForegroundColor Red
27

28
        # Check if RDP is currently enabled
29
        $rdpEnabled = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -ErrorAction SilentlyContinue
30
        if ($rdpEnabled -and $rdpEnabled.fDenyTSConnections -eq 0) {
31
            Write-Host "[!] RDP is currently ENABLED on the system" -ForegroundColor Red
32
            $this.Actions += @{
33
                Time = Get-Date
34
                Action = "RDP Status Check"
35
                Result = "RDP Enabled"
36
                Severity = "High"
37
            }
38
        }
39

40
        # Get current RDP sessions
41
        $activeSessions = quser 2>$null
42
        if ($activeSessions) {
43
            Write-Host "[!] Active RDP sessions detected:" -ForegroundColor Yellow
44
            $activeSessions | ForEach-Object { Write-Host "    $_" -ForegroundColor White }
45
            $this.Actions += @{
46
                Time = Get-Date
47
                Action = "Active Session Check"
48
                Result = "Active RDP sessions found"
49
                Severity = "Medium"
50
            }
51
        }
52

53
        # Check for suspicious processes
54
        $suspiciousProcesses = Get-Process | Where-Object {
55
            $_.ProcessName -match "mstsc|rdpclip|tscon|tsdiscon|rwinsta"
56
        }
57

58
        foreach ($process in $suspiciousProcesses) {
59
            $this.Evidence.ProcessArtifacts += @{
60
                ProcessId = $process.Id
61
                ProcessName = $process.ProcessName
62
                StartTime = $process.StartTime
63
                Path = $process.Path
64
                CommandLine = (Get-WmiObject Win32_Process -Filter "ProcessId=$($process.Id)").CommandLine
65
            }
66
        }
67
    }
68

69
    # Collect forensic evidence
70
    [void]CollectEvidence() {
71
        Write-Host "[*] Collecting forensic evidence..." -ForegroundColor Yellow
72

73
        # Collect recent Sysmon events
74
        $sysmonEvents = Get-WinEvent -FilterHashtable @{
75
            LogName = 'Microsoft-Windows-Sysmon/Operational'
76
            StartTime = $this.IncidentStart
77
        } -MaxEvents 10000 | Where-Object {
78
            $_.Message -match "rdp|mstsc|terminal|tscon|3389"
79
        }
80

81
        foreach ($event in $sysmonEvents) {
82
            $xml = [xml]$event.ToXml()
83
            $eventData = $xml.Event.EventData.Data
84

85
            switch ($event.Id) {
86
                1 {  # Process Creation
87
                    $this.Evidence.ProcessArtifacts += @{
88
                        EventId = $event.Id
89
                        TimeCreated = $event.TimeCreated
90
                        ProcessId = ($eventData | Where-Object {$_.Name -eq 'ProcessId'}).'#text'
91
                        Image = ($eventData | Where-Object {$_.Name -eq 'Image'}).'#text'
92
                        CommandLine = ($eventData | Where-Object {$_.Name -eq 'CommandLine'}).'#text'
93
                        User = ($eventData | Where-Object {$_.Name -eq 'User'}).'#text'
94
                        ParentImage = ($eventData | Where-Object {$_.Name -eq 'ParentImage'}).'#text'
95
                    }
96
                }
97
                3 {  # Network Connection
98
                    $this.Evidence.NetworkArtifacts += @{
99
                        EventId = $event.Id
100
                        TimeCreated = $event.TimeCreated
101
                        ProcessId = ($eventData | Where-Object {$_.Name -eq 'ProcessId'}).'#text'
102
                        Image = ($eventData | Where-Object {$_.Name -eq 'Image'}).'#text'
103
                        SourceIp = ($eventData | Where-Object {$_.Name -eq 'SourceIp'}).'#text'
104
                        DestinationIp = ($eventData | Where-Object {$_.Name -eq 'DestinationIp'}).'#text'
105
                        DestinationPort = ($eventData | Where-Object {$_.Name -eq 'DestinationPort'}).'#text'
106
                    }
107
                }
108
                11 { # File Create
109
                    $this.Evidence.FileArtifacts += @{
110
                        EventId = $event.Id
111
                        TimeCreated = $event.TimeCreated
112
                        ProcessId = ($eventData | Where-Object {$_.Name -eq 'ProcessId'}).'#text'
113
                        Image = ($eventData | Where-Object {$_.Name -eq 'Image'}).'#text'
114
                        TargetFilename = ($eventData | Where-Object {$_.Name -eq 'TargetFilename'}).'#text'
115
                    }
116
                }
117
                13 { # Registry Set
118
                    $this.Evidence.RegistryArtifacts += @{
119
                        EventId = $event.Id
120
                        TimeCreated = $event.TimeCreated
121
                        ProcessId = ($eventData | Where-Object {$_.Name -eq 'ProcessId'}).'#text'
122
                        Image = ($eventData | Where-Object {$_.Name -eq 'Image'}).'#text'
123
                        TargetObject = ($eventData | Where-Object {$_.Name -eq 'TargetObject'}).'#text'
124
                        Details = ($eventData | Where-Object {$_.Name -eq 'Details'}).'#text'
125
                    }
126
                }
127
            }
128
        }
129

130
        Write-Host "[*] Evidence collection completed:" -ForegroundColor Green
131
        Write-Host "    Process Artifacts: $($this.Evidence.ProcessArtifacts.Count)" -ForegroundColor Cyan
132
        Write-Host "    Network Artifacts: $($this.Evidence.NetworkArtifacts.Count)" -ForegroundColor Cyan
133
        Write-Host "    File Artifacts: $($this.Evidence.FileArtifacts.Count)" -ForegroundColor Cyan
134
        Write-Host "    Registry Artifacts: $($this.Evidence.RegistryArtifacts.Count)" -ForegroundColor Cyan
135
    }
136

137
    # Immediate containment actions
138
    [void]ContainmentActions() {
139
        Write-Host "[!] Executing containment actions..." -ForegroundColor Red
140

141
        # Option to disable RDP (commented out for safety)
142
        # Uncomment only if immediate containment is required
143
        <#
144
        $confirm = Read-Host "Disable RDP immediately? (y/N)"
145
        if ($confirm -eq "y" -or $confirm -eq "Y") {
146
            Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Value 1
147
            Write-Host "[!] RDP has been DISABLED" -ForegroundColor Red
148
            $this.Actions += @{
149
                Time = Get-Date
150
                Action = "RDP Containment"
151
                Result = "RDP Disabled"
152
                Severity = "High"
153
            }
154
        }
155
        #>
156

157
        # Block suspicious network connections
158
        $suspiciousIPs = $this.Evidence.NetworkArtifacts | Where-Object {
159
            $_.DestinationPort -eq "3389" -and $_.SourceIp -notmatch "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)"
160
        } | Select-Object -ExpandProperty SourceIp -Unique
161

162
        foreach ($ip in $suspiciousIPs) {
163
            Write-Host "[!] Blocking suspicious IP: $ip" -ForegroundColor Yellow
164
            # netsh advfirewall firewall add rule name="Block_$ip" dir=in action=block remoteip=$ip
165
            $this.Actions += @{
166
                Time = Get-Date
167
                Action = "IP Block"
168
                Result = "Blocked $ip"
169
                Severity = "Medium"
170
            }
171
        }
172

173
        # Terminate suspicious processes
174
        $suspiciousProcesses = $this.Evidence.ProcessArtifacts | Where-Object {
175
            $_.Image -match "temp|appdata" -and $_.Image -match "\.exe$"
176
        }
177

178
        foreach ($process in $suspiciousProcesses) {
179
            Write-Host "[!] Terminating suspicious process: $($process.Image) (PID: $($process.ProcessId))" -ForegroundColor Yellow
180
            # Stop-Process -Id $process.ProcessId -Force -ErrorAction SilentlyContinue
181
            $this.Actions += @{
182
                Time = Get-Date
183
                Action = "Process Termination"
184
                Result = "Terminated PID $($process.ProcessId)"
185
                Severity = "High"
186
            }
187
        }
188
    }
189

190
    # Generate incident report
191
    [hashtable]GenerateReport() {
192
        Write-Host "[*] Generating incident report..." -ForegroundColor Yellow
193

194
        $report = @{
195
            IncidentId = $this.IncidentId
196
            ComputerName = $this.ComputerName
197
            IncidentStart = $this.IncidentStart
198
            ReportGenerated = Get-Date
199
            Summary = @{
200
                TotalArtifacts = ($this.Evidence.ProcessArtifacts.Count + $this.Evidence.NetworkArtifacts.Count + $this.Evidence.FileArtifacts.Count + $this.Evidence.RegistryArtifacts.Count)
201
                ActionsExecuted = $this.Actions.Count
202
                CriticalActions = ($this.Actions | Where-Object {$_.Severity -eq "High"}).Count
203
            }
204
            Evidence = $this.Evidence
205
            Actions = $this.Actions
206
            Recommendations = @(
207
                "Change all user passwords immediately"
208
                "Review and audit user accounts with RDP access"
209
                "Implement MFA for remote access"
210
                "Review firewall rules for RDP access"
211
                "Conduct forensic imaging of affected systems"
212
                "Monitor for lateral movement to other systems"
213
                "Update incident response procedures based on lessons learned"
214
            )
215
        }
216

217
        # Save report to file
218
        $reportPath = "C:\Temp\RDP_Incident_$($this.IncidentId)_$(Get-Date -Format 'yyyyMMdd_HHmmss').json"
219
        $report | ConvertTo-Json -Depth 10 | Out-File -FilePath $reportPath -Encoding UTF8
220

221
        Write-Host "[*] Incident report saved to: $reportPath" -ForegroundColor Green
222

223
        return $report
224
    }
225

226
    # Execute full incident response
227
    [hashtable]ExecuteResponse() {
228
        Write-Host "=== RDP INCIDENT RESPONSE INITIATED ===" -ForegroundColor Red
229
        Write-Host "Incident ID: $($this.IncidentId)" -ForegroundColor Yellow
230
        Write-Host "Computer: $($this.ComputerName)" -ForegroundColor Yellow
231
        Write-Host "Start Time: $($this.IncidentStart)" -ForegroundColor Yellow
232

233
        $this.InitialTriage()
234
        $this.CollectEvidence()
235
        $this.ContainmentActions()
236
        $report = $this.GenerateReport()
237

238
        Write-Host "=== RDP INCIDENT RESPONSE COMPLETED ===" -ForegroundColor Green
239

240
        return $report
241
    }
242
}
243

244
# Usage example
245
# $incidentHandler = [RDPIncidentHandler]::new("INC-RDP-$(Get-Date -Format 'yyyyMMdd-HHmmss')", $env:COMPUTERNAME, (Get-Date).AddHours(-2))
246
# $incidentReport = $incidentHandler.ExecuteResponse()

Advanced Analytics and Correlation#

Machine Learning Detection#

1
#!/usr/bin/env python3
2
# rdp_ml_detection.py - Machine learning-based RDP anomaly detection
3

4
import pandas as pd
5
import numpy as np
6
from sklearn.ensemble import IsolationForest
7
from sklearn.preprocessing import StandardScaler
8
from sklearn.model_selection import train_test_split
9
import json
10
import logging
11
from datetime import datetime, timedelta
12

13
class RDPAnomalyDetector:
14
    def __init__(self):
15
        self.scaler = StandardScaler()
16
        self.model = IsolationForest(contamination=0.1, random_state=42)
17
        self.features = [
18
            'connection_count',
19
            'unique_destinations',
20
            'connection_duration_avg',
21
            'bytes_transferred',
22
            'failed_attempts',
23
            'time_of_day',
24
            'day_of_week',
25
            'connection_frequency'
26
        ]
27

28
    def extract_features(self, events):
29
        """Extract features from RDP events for ML analysis"""
30
        features = []
31

32
        # Group events by user and time window
33
        for user in events['user'].unique():
34
            user_events = events[events['user'] == user]
35

36
            # Extract time-based features
37
            user_events['timestamp'] = pd.to_datetime(user_events['timestamp'])
38
            user_events['hour'] = user_events['timestamp'].dt.hour
39
            user_events['day_of_week'] = user_events['timestamp'].dt.dayofweek
40

41
            # Calculate features for each time window (e.g., hourly)
42
            for window_start in pd.date_range(start=user_events['timestamp'].min(),
43
                                            end=user_events['timestamp'].max(),
44
                                            freq='H'):
45
                window_end = window_start + timedelta(hours=1)
46
                window_events = user_events[
47
                    (user_events['timestamp'] >= window_start) &
48
                    (user_events['timestamp'] < window_end)
49
                ]
50

51
                if len(window_events) == 0:
52
                    continue
53

54
                feature_vector = {
55
                    'user': user,
56
                    'timestamp': window_start,
57
                    'connection_count': len(window_events),
58
                    'unique_destinations': window_events['destination_ip'].nunique(),
59
                    'connection_duration_avg': window_events['duration'].mean() if 'duration' in window_events else 0,
60
                    'bytes_transferred': window_events['bytes_transferred'].sum() if 'bytes_transferred' in window_events else 0,
61
                    'failed_attempts': len(window_events[window_events['status'] == 'failed']),
62
                    'time_of_day': window_start.hour,
63
                    'day_of_week': window_start.weekday(),
64
                    'connection_frequency': len(window_events) / 3600  # connections per second
65
                }
66

67
                features.append(feature_vector)
68

69
        return pd.DataFrame(features)
70

71
    def train_model(self, training_data):
72
        """Train the anomaly detection model"""
73
        feature_matrix = training_data[self.features]
74
        feature_matrix_scaled = self.scaler.fit_transform(feature_matrix)
75

76
        self.model.fit(feature_matrix_scaled)
77

78
        # Calculate baseline metrics
79
        scores = self.model.decision_function(feature_matrix_scaled)
80
        anomaly_threshold = np.percentile(scores, 10)  # Bottom 10% as anomalies
81

82
        return {
83
            'training_samples': len(training_data),
84
            'anomaly_threshold': anomaly_threshold,
85
            'model_trained': True
86
        }
87

88
    def detect_anomalies(self, events):
89
        """Detect anomalies in RDP events"""
90
        features = self.extract_features(events)
91

92
        if len(features) == 0:
93
            return []
94

95
        feature_matrix = features[self.features]
96
        feature_matrix_scaled = self.scaler.transform(feature_matrix)
97

98
        # Predict anomalies
99
        anomaly_scores = self.model.decision_function(feature_matrix_scaled)
100
        anomaly_predictions = self.model.predict(feature_matrix_scaled)
101

102
        # Combine results
103
        results = features.copy()
104
        results['anomaly_score'] = anomaly_scores
105
        results['is_anomaly'] = anomaly_predictions == -1
106

107
        # Return only anomalies
108
        anomalies = results[results['is_anomaly']].to_dict('records')
109

110
        return anomalies
111

112
    def analyze_rdp_patterns(self, events):
113
        """Analyze RDP usage patterns for baseline establishment"""
114
        analysis = {
115
            'temporal_patterns': {},
116
            'user_behavior': {},
117
            'network_patterns': {},
118
            'risk_indicators': []
119
        }
120

121
        # Temporal analysis
122
        events['timestamp'] = pd.to_datetime(events['timestamp'])
123
        events['hour'] = events['timestamp'].dt.hour
124
        events['day_of_week'] = events['timestamp'].dt.dayofweek
125

126
        hourly_activity = events['hour'].value_counts().sort_index()
127
        daily_activity = events['day_of_week'].value_counts().sort_index()
128

129
        analysis['temporal_patterns'] = {
130
            'peak_hours': hourly_activity.idxmax(),
131
            'low_activity_hours': hourly_activity.idxmin(),
132
            'weekend_activity': daily_activity[5:].sum(),  # Sat-Sun
133
            'weekday_activity': daily_activity[:5].sum()   # Mon-Fri
134
        }
135

136
        # User behavior analysis
137
        user_stats = events.groupby('user').agg({
138
            'destination_ip': 'nunique',
139
            'timestamp': ['count', lambda x: (x.max() - x.min()).total_seconds() / 3600]
140
        }).round(2)
141

142
        analysis['user_behavior'] = user_stats.to_dict('index')
143

144
        # Network pattern analysis
145
        network_stats = events.groupby('destination_ip').agg({
146
            'user': 'nunique',
147
            'timestamp': 'count'
148
        })
149

150
        analysis['network_patterns'] = {
151
            'most_accessed_hosts': network_stats.sort_values('timestamp', ascending=False).head().to_dict('index'),
152
            'hosts_with_multiple_users': network_stats[network_stats['user'] > 1].to_dict('index')
153
        }
154

155
        # Risk indicators
156
        if len(events[events['timestamp'].dt.hour.isin([0, 1, 2, 3, 4, 5])]) > 0:
157
            analysis['risk_indicators'].append('Off-hours activity detected')
158

159
        if events['user'].nunique() > 10:
160
            analysis['risk_indicators'].append('High number of unique users')
161

162
        failed_rate = len(events[events['status'] == 'failed']) / len(events)
163
        if failed_rate > 0.1:
164
            analysis['risk_indicators'].append(f'High failure rate: {failed_rate:.2%}')
165

166
        return analysis
167

168
# Example usage
169
def main():
170
    # Sample data structure - replace with actual Sysmon data parsing
171
    sample_events = pd.DataFrame([
172
        {'user': 'user1', 'destination_ip': '192.168.1.100', 'timestamp': '2025-01-10 09:00:00', 'status': 'success', 'duration': 3600, 'bytes_transferred': 1024000},
173
        {'user': 'user1', 'destination_ip': '192.168.1.101', 'timestamp': '2025-01-10 14:00:00', 'status': 'success', 'duration': 1800, 'bytes_transferred': 512000},
174
        {'user': 'user2', 'destination_ip': '192.168.1.100', 'timestamp': '2025-01-10 02:00:00', 'status': 'failed', 'duration': 0, 'bytes_transferred': 0},
175
        # Add more sample data...
176
    ])
177

178
    detector = RDPAnomalyDetector()
179

180
    # Analyze patterns
181
    patterns = detector.analyze_rdp_patterns(sample_events)
182
    print("RDP Usage Patterns:")
183
    print(json.dumps(patterns, indent=2, default=str))
184

185
    # Train model (in practice, use historical data)
186
    features = detector.extract_features(sample_events)
187
    if len(features) > 0:
188
        training_result = detector.train_model(features)
189
        print(f"\nModel Training: {training_result}")
190

191
        # Detect anomalies
192
        anomalies = detector.detect_anomalies(sample_events)
193
        if anomalies:
194
            print(f"\nDetected {len(anomalies)} anomalies:")
195
            for anomaly in anomalies:
196
                print(f"- User: {anomaly['user']}, Time: {anomaly['timestamp']}, Score: {anomaly['anomaly_score']:.3f}")
197
        else:
198
            print("\nNo anomalies detected")
199

200
if __name__ == "__main__":
201
    main()

Best Practices and Recommendations#

Sysmon Configuration Best Practices#

Event Selection
- Focus on high-value events (1, 3, 7, 10, 11, 13)
- Use targeted filtering to reduce noise
- Regular review and tuning of rules
Performance Optimization
- Monitor Sysmon overhead
- Use exclude rules for known-good processes
- Implement log rotation and archival
Detection Engineering
- Develop use-case specific rules
- Test detection rules thoroughly
- Implement alerting thresholds
Incident Response Integration
- Automate evidence collection
- Create standardized playbooks
- Practice incident scenarios

Terminal Services Security Hardening#

Configuration Security
- Enable Network Level Authentication
- Use strong encryption levels
- Implement session timeouts
- Disable unused features (clipboard, drive redirection)
Access Controls
- Implement least privilege principles
- Use certificate-based authentication
- Regular access reviews
- Monitor privileged accounts
Network Security
- Change default RDP port
- Implement network segmentation
- Use VPN for external access
- Monitor network traffic
Monitoring and Alerting
- Real-time session monitoring
- Failed logon alerting
- Configuration change detection
- Behavioral analytics

Conclusion#

This comprehensive guide provides the foundation for implementing advanced Terminal Services monitoring using Sysmon. The configuration and detection rules enable organizations to:

Detect Advanced Threats: Identify sophisticated RDP-based attacks
Monitor Configuration Changes: Track modifications to Terminal Services settings
Hunt for Persistence: Discover backdoors and persistence mechanisms
Respond to Incidents: Execute structured incident response procedures
Analyze Patterns: Use machine learning for anomaly detection

Key benefits of this approach:

Comprehensive Coverage: All aspects of RDP security monitoring
Actionable Intelligence: Detection rules that minimize false positives
Scalable Detection: Suitable for enterprise environments
Incident Ready: Integrated response and analysis capabilities

By implementing these monitoring strategies, security teams can significantly improve their ability to detect, analyze, and respond to Terminal Services-based threats while maintaining operational visibility and security posture.

Remember to test all configurations in a lab environment before deploying to production systems and regularly update detection rules based on emerging threats.