Outbound RDP initiated by a process that is not an RDP client

Siemphony@siemphonymediumT1021.001unverifiedPlaybook · Lateral movement

Matches a host opening an outbound connection to the Remote Desktop port when the process making it is not one of the shipped Remote Desktop clients. AN0931 lists the logon record and the network connection side by side; the logon record describes the destination host and says only that someone signed in, which on its own is a report of RDP usage rather than a detection. The network event is the source side of the same session, and it names the process, which is the part an adversary cannot avoid: credential-reuse tooling, a SOCKS or port-forward proxy, and a script driving RDP all reach 3389 from something that is not mstsc.exe or msrdc.exe. `Initiated` is pinned to true so the rule stays on the connecting host and does not re-report every inbound session on the terminal server. The post-access half of the analytic — unusual process execution inside a time window after the logon — is a correlation Sigma cannot express and is not attempted. Two limits worth stating: Sysmon network connection logging is not enabled by a default install and is filtered down hard in the widely used configurations, so an empty result means the feed is off rather than the estate is quiet; and the port is the literal default, so RDP moved to another port is invisible here. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0327, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 2 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Outbound RDP initiated by a process that is not an RDP client2id: 9a5c9d9a-4c06-4f1e-a244-2d84bd10030c3status: experimental4description: |5  Matches a host opening an outbound connection to the Remote Desktop port when6  the process making it is not one of the shipped Remote Desktop clients. AN09317  lists the logon record and the network connection side by side; the logon8  record describes the destination host and says only that someone signed in,9  which on its own is a report of RDP usage rather than a detection. The network10  event is the source side of the same session, and it names the process, which11  is the part an adversary cannot avoid: credential-reuse tooling, a SOCKS or12  port-forward proxy, and a script driving RDP all reach 3389 from something13  that is not mstsc.exe or msrdc.exe. `Initiated` is pinned to true so the rule14  stays on the connecting host and does not re-report every inbound session on15  the terminal server. The post-access half of the analytic — unusual process16  execution inside a time window after the logon — is a correlation Sigma cannot17  express and is not attempted. Two limits worth stating: Sysmon network18  connection logging is not enabled by a default install and is filtered down19  hard in the widely used configurations, so an empty result means the feed is20  off rather than the estate is quiet; and the port is the literal default, so21  RDP moved to another port is invisible here.22  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0327, not hand-written and not tested by its author. Any lab result is on this rule's own page.23references:24  - https://attack.mitre.org/techniques/T1021/00125  - https://attack.mitre.org/detectionstrategies/DET032726author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)27date: 2026-08-1628tags:29  - attack.lateral-movement30  - attack.t1021.00131logsource:32  category: network_connection33  product: windows34detection:35  selection:36    DestinationPort: 338937    Initiated: 'true'38  filter_rdp_clients:39    Image|endswith:40      - '\mstsc.exe'41      - '\msrdc.exe'42  condition: selection and not filter_rdp_clients43falsepositives:44  - "Third-party session managers and connection brokers — RDCMan, mRemoteNG, Remote Desktop Manager, Royal TS and similar — which host the RDP control themselves and therefore open 3389 under their own image name. These are the rule's top talkers on any administrator workstation and are deliberately left out of the filter, because the same shape is what a custom client looks like; allowlist the ones your estate actually deploys, by image and by user."45  - "Vulnerability scanners, asset-discovery and network-inventory tooling sweeping 3389 across the estate. One scanner host produces a connection per target and will dominate the volume, so scope by source host rather than by process name."46  - "Administrative port-forwarding and tunnelling — ssh.exe, plink.exe or a VPN client relaying a desktop session — which is indistinguishable from an adversary tunnelling RDP and separated only by who ran it. MITRE's UserContext and HostAccessPatterns knobs are aimed at this, the second by keeping only first-time source-to-destination pairs, which needs baselining outside the rule."47  - "Remote-support, patching and monitoring agents that broker or health-check a Remote Desktop listener on a schedule, appearing as a service process connecting to 3389 at a fixed interval."48level: medium

Splunk · SPL

Run this as a search.

index=* ((DestinationPort="3389" AND Initiated="true") AND NOT ((Image="*\\mstsc.exe" OR Image="*\\msrdc.exe")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,network_connection,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="DestinationPort" type="pcre2">(?i)^3389$</field>    <field name="Initiated" type="pcre2">(?i)^true$</field>    <field name="Image" negate="yes" type="pcre2">(?i)(\\mstsc\.exe$|\\msrdc\.exe$)</field>    <description>Outbound RDP initiated by a process that is not an RDP client</description>    <mitre>      <id>T1021.001</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. `Initiated` has no Sentinel column: Defender expresses connection direction in `ActionType`, not as a boolean column, so `Initiated` cannot be renamed — it needs a different predicate. The Sigma source is on the first tab, unchanged.

Elastic · ES|QL

Run this as a search.

Elastic cannot express this construct. `Initiated` has no ECS field: ECS expresses connection direction as `network.direction` with values like `egress`, not as a boolean, so `Initiated` needs a different predicate rather than a rename. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: network_connection / windows
Level: medium
Category: lateral_movement_remote_exec
Sigma status: experimental
Backends: 2 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 9a5c9d9a-4c06-4f1e-a244-2d84bd10030c

ATT&CKT1021.001

T1021.001Remote Desktop Protocol

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 2 fired

Fires on none of the 2 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 2 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1021.001, evaluated against their network_connection events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

level: medium is set against a top false positive the author explicitly declines to filter. A rule whose acknowledged dominant volume is unfiltered is a triage queue, not a medium alert — either ship the session-manager images as a filter block or drop to low until your allowlist is populated. That trade, level against your own first false positive, is the calibration to internalise.
Anchor the filter to \Windows\System32\ and \Program Files\, or pair it with OriginalFileName. Add \msrdcw.exe.
MITRE's HostAccessPatterns knob — keep only first-time source-to-destination pairs — is the most valuable tuning here, and it needs baselining state no Sigma rule holds. UserContext and TimeWindow are the other knobs, both belonging to the correlation layer above this YAML.

Declared by the author

Third-party session managers and connection brokers — RDCMan, mRemoteNG, Remote Desktop Manager, Royal TS and similar — which host the RDP control themselves and therefore open 3389 under their own image name. These are the rule's top talkers on any administrator workstation and are deliberately left out of the filter, because the same shape is what a custom client looks like; allowlist the ones your estate actually deploys, by image and by user.
Vulnerability scanners, asset-discovery and network-inventory tooling sweeping 3389 across the estate. One scanner host produces a connection per target and will dominate the volume, so scope by source host rather than by process name.
Administrative port-forwarding and tunnelling — ssh.exe, plink.exe or a VPN client relaying a desktop session — which is indistinguishable from an adversary tunnelling RDP and separated only by who ran it. MITRE's UserContext and HostAccessPatterns knobs are aimed at this, the second by keeping only first-time source-to-destination pairs, which needs baselining outside the rule.
Remote-support, patching and monitoring agents that broker or health-check a Remote Desktop listener on a schedule, appearing as a service process connecting to 3389 at a fixed interval.

Lessonlateral movement remote exec

lateral movement remote execAI draft — unreviewed

01 · What this rule detects

An outbound connection to TCP 3389 from a process that is not one of the two shipped Remote Desktop clients. MITRE's AN0931 pairs a logon record with a network connection, then asks for "unusual process execution within a short timeframe" after it. Two of those three pieces are out of reach: the correlation needs a time join Sigma has no construct for, and the logon record — Security 4624 on the destination — says only that someone signed in, which is a report of RDP usage rather than a detection. The author took the source side: Sysmon EventID 3, on the machine that opened the socket, which names the process. Initiated: 'true' keeps the rule on the connecting host so a terminal server does not re-report every inbound session it accepts.

02 · Telemetry you need

Sysmon EventID 3. Network connection logging is off in a default Sysmon install and filtered hard in the common community configs, so an empty result means the feed is off, not that the estate is quiet — the rule says so, correctly.
sentinel_kql is refused, and the refusal is instructive: Initiated has no Defender column, because direction there lives in ActionType rather than a boolean. The translator was right to refuse instead of emitting KQL that silently drops the direction gate.

03 · How the logic works

Three lines of logic, and the whole detection rests on the filter. Trace the modal attack. An operator with stolen credentials sits on a compromised jumpbox, opens mstsc.exe, and RDPs to a file server. That is T1021.001 exactly as ATT&CK defines it — "use Valid Accounts to log into a computer using RDP". And filter_rdp_clients removes it. What is left is the non-native-client subset: SOCKS proxies, port forwards, SharpRDP-style tooling. Real adversary behaviour, worth catching. But the description sells the process name as "the part an adversary cannot avoid", and the process name is exactly the part an adversary can avoid, by using the shipped client like everybody else. A learner reads the title as RDP lateral movement coverage, and it is not that. This is the lesson. A not block does not merely reduce noise — it defines what the rule can never see. Before you write one, name the attack it removes. If that attack is the technique's own default path, say so in the description in plain words. Two consequences. Image|endswith: '\mstsc.exe' has no path, signature or OriginalFileName anchor, so copying any RDP tool to %TEMP% as mstsc.exe inherits the exclusion — the filter is a rename away from being an allowlist the attacker controls. And it names two clients where Microsoft ships three: the modern Windows App client (msrdcw.exe) is missing, so every routine session from an up-to-date client alerts. First-day, every-user, and absent from the falsepositives block. DestinationPort: 3389 is the literal default, so RDP moved to another port is invisible — the rule says this, and saying it is right.

04 · Common false positives

Third-party session managers — RDCMan, mRemoteNG, Royal TS — which host the
Vulnerability scanners sweeping 3389; one scanner emits a connection per
Administrative tunnelling via ssh.exe or plink.exe, indistinguishable from
Sanctioned RDP from msrdcw.exe, unlisted and unfiltered.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0327 and never executed against a single log line.
tier_2: run it over historical EventID 3, confirm Initiated is populated, and enumerate which RDP clients your estate actually runs.
tier_3: is the first-time-pair baseline and the post-logon process correlation, neither of which lives in a Sigma rule.

Related detections3 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/9a5c9d9a-4c06-4f1e-a244-2d84bd10030c

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Outbound RDP initiated by a process that is not an RDP client

The detection

detection.yml

Splunk · SPL

Wazuh · XML rule

Sentinel · KQL

Elastic · ES|QL

Community

Verdicts from engineers who deployed it