https://feed.craftedsignal.io/products/remote-desktop-services/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 14:30:00 +0000https://feed.craftedsignal.io/briefs/2024-01-rdp-internet/Wed, 03 Jan 2024 14:30:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-rdp-internet/This rule detects network events indicative of RDP traffic originating from the internet, which poses a significant security risk due to its frequent exploitation as an initial access or backdoor vector.Remote Desktop Protocol (RDP) is a common tool for system administrators to remotely manage systems, however, exposing RDP directly to the internet creates a significant attack surface. Threat actors frequently target and exploit RDP for initial access, lateral movement, and establishing backdoors within compromised networks. This activity is detected by monitoring network traffic for RDP connections originating from outside the internal network (RFC1918 IP ranges). This is important because successful RDP compromise often leads to broader network infiltration and data exfiltration. This detection focuses on the network level characteristics of RDP connections from the internet to internal assets.

Attack Chain

1. An attacker identifies a publicly accessible RDP service.
2. The attacker attempts to brute-force RDP login credentials or exploits a known RDP vulnerability (e.g. BlueKeep CVE-2019-0708).
3. Upon successful authentication or exploitation, the attacker gains remote access to the targeted system.
4. The attacker uses the compromised system as a pivot point to perform reconnaissance on the internal network.
5. The attacker moves laterally within the network using stolen credentials or by exploiting other vulnerabilities.
6. The attacker installs malware or establishes persistence mechanisms (e.g., creating new user accounts or modifying system configurations).
7. The attacker gathers sensitive data from internal systems.
8. The attacker exfiltrates the stolen data to an external server or deploys ransomware.

Impact

Compromised RDP services can lead to significant data breaches, system downtime, and financial losses. Attackers can leverage RDP access to steal sensitive information, install ransomware, or disrupt critical business operations. While the number of affected organizations varies, RDP exploitation remains a prevalent attack vector, especially for organizations with inadequate security practices. The impact of a successful RDP attack ranges from several thousands to millions of dollars, depending on the size of the organization and the sensitivity of the compromised data.

Recommendation

• Deploy the "RDP (Remote Desktop Protocol) from the Internet" Sigma rule to your SIEM to detect unauthorized RDP connections from outside the network.
• Review firewall rules and network configurations to ensure RDP services are not exposed directly to the internet. Implement a VPN or RDP gateway for secure remote access.
• Enable and monitor network traffic logs (category: network_traffic, product: windows|linux|macos) to provide data for the Sigma rule.
• Investigate any alerts generated by the Sigma rule, focusing on the source IP address and user accounts involved in the RDP connection.
• Implement network segmentation to limit the blast radius of a potential RDP compromise.

]]>mediumadvisorycommand-and-controllateral-movementinitial-accessrdphttps://feed.craftedsignal.io/briefs/2024-01-02-rdp-shadowing/Tue, 02 Jan 2024 15:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-02-rdp-shadowing/This rule detects potential Remote Desktop Shadowing activity by identifying modifications to the RDP Shadow registry or the execution of processes indicative of an active RDP shadowing session that allows adversaries to spy on or control other user's RDP sessions.Remote Desktop Shadowing is a feature intended for legitimate administrative purposes, allowing administrators to view or control active RDP sessions for support and troubleshooting. However, adversaries can abuse this feature to monitor or hijack user sessions without consent, leading to unauthorized access and data compromise. This activity is detected by monitoring for modifications to the RDP Shadow registry settings and the execution of specific processes linked to shadowing, such as "RdpSaUacHelper.exe", "RdpSaProxy.exe", and "mstsc.exe" with the "/shadow:*" argument. The rule identifies suspicious modifications to RDP Shadow registry settings, specifically changes in "HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\Shadow", and the execution of associated processes by "svchost.exe". This activity can originate from internal or external actors and has been observed in various attacks aimed at lateral movement and data theft. Defenders should prioritize detection and prevention of RDP shadowing to prevent unauthorized access and session hijacking.

Attack Chain

1. The attacker gains initial access to the target system through compromised credentials or other means.
2. The attacker modifies the RDP Shadow registry key HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\Shadow to enable shadowing. This may involve setting the value to "1", "2", "3", or "4".
3. The attacker uses svchost.exe to launch RdpSaUacHelper.exe or RdpSaProxy.exe to initiate the shadowing session.
4. Alternatively, the attacker directly executes mstsc.exe with the /shadow:<session ID> argument to target a specific RDP session.
5. The compromised host connects to the target RDP session, allowing the attacker to view or control the user's session.
6. The attacker monitors the user's activity, captures sensitive information, or performs malicious actions within the compromised session.
7. The attacker may use the compromised session to move laterally to other systems on the network.

Impact

Successful RDP shadowing allows an attacker to gain unauthorized access to sensitive information displayed on the user's screen. This can include credentials, financial data, or proprietary information. The attacker can also control the user's session, potentially leading to data theft, system compromise, or further lateral movement within the network. This can result in significant financial losses, reputational damage, and legal liabilities. The number of affected users depends on the scope of the attack and the number of RDP sessions targeted.

Recommendation

• Monitor registry modifications to HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\Shadow using a registry monitoring tool and deploy the "RDP Shadow Registry Modification" Sigma rule.
• Alert on the execution of RdpSaUacHelper.exe or RdpSaProxy.exe spawned by svchost.exe using the "RDP Shadow Process Execution" Sigma rule.
• Monitor for the execution of mstsc.exe with the /shadow argument using the "RDP Shadow MSTSC Execution" Sigma rule.
• Review and harden RDP access policies, including multi-factor authentication and limiting RDP access to only necessary users and systems.
• Implement enhanced monitoring and logging for RDP activities across the network.

]]>highadvisorylateral-movementrdp-shadowingwindows