Detectionhighexperimental

OpenCanary - RDP New Connection Attempt

Detects instances where an RDP service on an OpenCanary node has had a connection attempt.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Marco PedrinazziCreated Tue Jan 06598290cf-5932-45cd-9123-be1e05ab4f2eapplication

Log Source

opencanaryapplication

Productopencanary← raw: opencanary

Categoryapplication← raw: application

Detection Logic

detection:
    selection:
        logtype: 14001
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

MITRE ATT&CK

Tactics

Techniques

Sub-techniques

Rule Metadata

Rule ID

598290cf-5932-45cd-9123-be1e05ab4f2e

Status

experimental

Level

high

Type

Detection

Created

Tue Jan 06

Author

Path

rules/application/opencanary/opencanary_rdp_connection_attempt.yaml

Raw Tags

attack.initial-accessattack.lateral-movementattack.t1133attack.t1021.001