潜在 SharpRDP 行为
编辑潜在 SharpRDP 行为编辑
识别 SharpRDP 的潜在行为，SharpRDP 是一种工具，可用于通过远程桌面协议 (RDP) 对远程目标执行经过身份验证的命令执行，以进行横向移动。
规则类型: eql
规则索引:
- logs-endpoint.events.process-*
- logs-endpoint.events.registry-*
- logs-endpoint.events.network-*
严重性: 高
风险评分: 73
每隔: 5 分钟运行一次
从以下时间开始搜索索引: now-9m（日期数学格式，另请参见 Additional look-back time）
每次执行的最大警报数: 100
参考:
标签:
- 域：端点
- 操作系统：Windows
- 用例：威胁检测
- 策略：横向移动
- 数据源：Elastic Defend
版本: 106
规则作者:
- Elastic
规则许可证: Elastic 许可证 v2
规则查询编辑
/* Incoming RDP followed by a new RunMRU string value set to cmd, powershell, taskmgr or tsclient, followed by process execution within 1m */
sequence by host.id with maxspan=1m
[network where host.os.type == "windows" and event.type == "start" and process.name : "svchost.exe" and destination.port == 3389 and
network.direction : ("incoming", "ingress") and network.transport == "tcp" and
source.ip != "127.0.0.1" and source.ip != "::1"
]
[registry where host.os.type == "windows" and process.name : "explorer.exe" and
registry.path : ("HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU\\*") and
registry.data.strings : ("cmd.exe*", "powershell.exe*", "taskmgr*", "\\\\tsclient\\*.exe\\*")
]
[process where host.os.type == "windows" and event.type == "start" and
(process.parent.name : ("cmd.exe", "powershell.exe", "taskmgr.exe") or process.args : ("\\\\tsclient\\*.exe")) and
not process.name : "conhost.exe"
]
框架：MITRE ATT&CKTM
-
策略
- 名称：横向移动
- ID：TA0008
- 参考网址：https://attack.mitre.org/tactics/TA0008/
-
技术
- 名称：远程服务
- ID：T1021
- 参考网址：https://attack.mitre.org/techniques/T1021/
-
子技术
- 名称：远程桌面协议
- ID：T1021.001
- 参考网址：https://attack.mitre.org/techniques/T1021/001/