savedsearch.conf

[Suspected Reverse Tunnel] description = This alert detects RDP tunnel network communications to and from a victim workstation. search = index=win EventCode="5156" ((Source_Port="3389" (Destination_Address="127.*" OR Destination_Address="::1")) OR (Destination_Port="3389" (Source_Address="127.*" OR Source_Address="::1"))) | stats count by Source_Address Source_Port Destination_Address Destination_Port action ComputerName _time Direction cron_schedule = 5 * * * * action.notable.param.severity = high action.correlationsearch.annotations = {"mitre_attack": ["T1572"]}

SigmaRule.yml

title: Suspected Reverse Tunnel id: 123e4567-e89b-12d3-a456-426614174000 description: This alert detects RDP tunnel network communications to and from a victim workstation. author: Splunk2Sigma date: 01/08/2024 tags: - attack.t1572 logsource: product: windows service: security detection: selection: EventCode: 5156 Source_Port: 3389 Destination_Address: - 127.* - "::1" selection2: EventCode: 5156 Destination_Port: 3389 Source_Address: - 127.* - "::1" condition: selection or selection2 falsepositives: - Unknown level: high