Update RDP_Nesting.yaml

Detections/SecurityEvent/RDP_Nesting.yaml

@@ -24,169 +24,139 @@ relevantTechniques:
   - T1021
 query: |
   let endtime = 1d;
-  let starttime = 8d;
-  // The threshold below excludes matching on RDP connection computer counts of 5 or more by a given account and IP in a given day. Change the threshold as needed.
-  let threshold = 5;
   // Function to resolve hostname to IP address using DNS logs or a lookup table (example syntax)
-  let rdpConnections = 
-      (union isfuzzy=true
-          (
-          SecurityEvent
-          | where TimeGenerated >= ago(endtime)
-          | where EventID == 4624 and LogonType == 10
-          // Labeling the first RDP connection time, computer and ip
-          | extend
-              FirstHop = bin(TimeGenerated, 1m),
-              FirstComputer = toupper(Computer),
-              FirstIPAddress = IpAddress,
-              Account = tolower(Account)
-          ),
-          (
-          WindowsEvent
-          | where TimeGenerated >= ago(endtime)
-          | where EventID == 4624 and EventData has ("10")
-          | extend LogonType = tostring(EventData.LogonType)
-          | where LogonType == 10 // Labeling the first RDP connection time, computer and ip
-          | extend Account = strcat(tostring(EventData.TargetDomainName), "\\", tostring(EventData.TargetUserName))
-          | extend IpAddress = tostring(EventData.IpAddress)
-          | extend
-              FirstHop = bin(TimeGenerated, 1m),
-              FirstComputer = toupper(Computer),
-              FirstIPAddress = IpAddress,
-              Account = tolower(Account)
-          ))
-      | join kind=inner (
-          (union isfuzzy=true
-              (
-              SecurityEvent
-              | where TimeGenerated >= ago(endtime)
-              | where EventID == 4624 and LogonType == 10
-              // Labeling the second RDP connection time, computer and ip
-              | extend
-                  SecondHop = bin(TimeGenerated, 1m),
-                  SecondComputer = toupper(Computer),
-                  SecondIPAddress = IpAddress,
-                  Account = tolower(Account)
-              ),
-              (
-              WindowsEvent
-              | where TimeGenerated >= ago(endtime)
-              | where EventID == 4624 and EventData has ("10")
-              | extend LogonType = toint(EventData.LogonType)
-              | where LogonType == 10 // Labeling the second RDP connection time, computer and ip
-              | extend Account = strcat(tostring(EventData.TargetDomainName), "\\", tostring(EventData.TargetUserName))
-              | extend IpAddress = tostring(EventData.IpAddress)
-              | extend
-                  SecondHop = bin(TimeGenerated, 1m),
-                  SecondComputer = toupper(Computer),
-                  SecondIPAddress = IpAddress,
-                  Account = tolower(Account)
-              ))
-          )
-          on Account
-      // Ensure the first connection is before the second connection
-      // Identify only RDP to another computer from within the first RDP connection by only choosing matches where the Computer names do not match
-      // Ensure the IPAddresses do not match by excluding connections from the same computers with first hop RDP connections to multiple computers
-      | where FirstComputer != SecondComputer
-          and FirstIPAddress != SecondIPAddress
-          and SecondHop > FirstHop
-      // Ensure the second hop occurs within 30 minutes of the first hop
-      | where SecondHop <= FirstHop + 30m
-      | distinct
-          Account,
-          FirstHop,
-          FirstComputer,
-          FirstIPAddress,
-          SecondHop,
-          SecondComputer,
-          SecondIPAddress,
-          AccountType,
-          Activity,
-          LogonTypeName,
-          ProcessName;        
+  let rdpConnections =
+  (union isfuzzy=true
+  (
+  SecurityEvent
+  | where TimeGenerated >= ago(endtime)
+  | where EventID == 4624 and LogonType == 10
+  // Labeling the first RDP connection time, computer and ip
+  | extend
+  FirstHop = bin(TimeGenerated, 1m),
+  FirstComputer = toupper(Computer),
+  FirstRemoteIPAddress = IpAddress,
+  Account = tolower(Account)
+  ),
+  (
+  WindowsEvent
+  | where TimeGenerated >= ago(endtime)
+  | where EventID == 4624 and EventData has ("10")
+  | extend LogonType = tostring(EventData.LogonType)
+  | where LogonType == 10 // Labeling the first RDP connection time, computer and ip
+  | extend Account = strcat(tostring(EventData.TargetDomainName), "", tostring(EventData.TargetUserName))
+  | extend IpAddress = tostring(EventData.IpAddress)
+  | extend
+  FirstHop = bin(TimeGenerated, 1m),
+  FirstComputer = toupper(Computer),
+  FirstRemoteIPAddress = IpAddress,
+  Account = tolower(Account)
+  ))
+  | join kind=inner (
+  (union isfuzzy=true
+  (
+  SecurityEvent
+  | where TimeGenerated >= ago(endtime)
+  | where EventID == 4624 and LogonType == 10
+  // Labeling the second RDP connection time, computer and ip
+  | extend
+  SecondHop = bin(TimeGenerated, 1m),
+  SecondComputer = toupper(Computer),
+  SecondRemoteIPAddress = IpAddress,
+  Account = tolower(Account)
+  ),
+  (
+  WindowsEvent
+  | where TimeGenerated >= ago(endtime)
+  | where EventID == 4624 and EventData has ("10")
+  | extend LogonType = toint(EventData.LogonType)
+  | where LogonType == 10 // Labeling the second RDP connection time, computer and ip
+  | extend Account = strcat(tostring(EventData.TargetDomainName), "", tostring(EventData.TargetUserName))
+  | extend IpAddress = tostring(EventData.IpAddress)
+  | extend
+  SecondHop = bin(TimeGenerated, 1m),
+  SecondComputer = toupper(Computer),
+  SecondRemoteIPAddress = IpAddress,
+  Account = tolower(Account)
+  ))
+  )
+  on Account
+  | distinct
+  Account,
+  FirstHop,
+  FirstComputer,
+  FirstRemoteIPAddress,
+  SecondHop,
+  SecondComputer,
+  SecondRemoteIPAddress,
+  AccountType,
+  Activity,
+  LogonTypeName,
+  ProcessName;
   // Resolve hostnames to IP addresses device network Ip's
   let listOfFirstComputer = rdpConnections | distinct FirstComputer;
   let listOfSecondComputer = rdpConnections | distinct SecondComputer;
-  let resolvedIPs =  
-      DeviceNetworkInfo
-      | where TimeGenerated >= ago(endtime)
-      | where isnotempty(ConnectedNetworks) and NetworkAdapterStatus == "Up"
-      | extend ClientIP = tostring(parse_json(IPAddresses[0]).IPAddress)
-      | where isnotempty(ClientIP)
-      | where DeviceName in~  (listOfFirstComputer) or DeviceName in~ (listOfSecondComputer)
-      | summarize arg_max(TimeGenerated, ClientIP) by Computer= DeviceName
-      | project Computer=toupper(Computer), ResolvedIP = ClientIP;
+  let resolvedIPs =
+  DeviceNetworkInfo
+  | where TimeGenerated >= ago(endtime)
+  | where isnotempty(ConnectedNetworks) and NetworkAdapterStatus == "Up"
+  | extend ClientIP = tostring(parse_json(IPAddresses[0]).IPAddress)
+  | where isnotempty(ClientIP)
+  | where DeviceName in~ (listOfFirstComputer) or DeviceName in~ (listOfSecondComputer)
+  | summarize arg_max(TimeGenerated, ClientIP) by Computer= DeviceName
+  | project Computer=toupper(Computer), ResolvedIP = ClientIP;
   // Join resolved IPs with the RDP connections
   rdpConnections
   | join kind=inner (resolvedIPs) on $left.FirstComputer == $right.Computer
   | join kind=inner (resolvedIPs) on $left.SecondComputer == $right.Computer
-  | where ResolvedIP != ResolvedIP1
+  // | where ResolvedIP != ResolvedIP1
   | distinct
-      Account,
-      FirstHop,
-      FirstComputer,
-      FirstIPAddress,
-      SecondHop,
-      SecondComputer,
-      SecondIPAddress,
-      AccountType,
-      Activity,
-      LogonTypeName,
-      ProcessName
-  // Use left anti to exclude anything from the previous 7 days where the Account and IP has connected to 5 or more computers.
-  | join kind=leftanti (
-      (union isfuzzy=true
-          (
-          SecurityEvent
-          | where TimeGenerated >= ago(starttime) and TimeGenerated < ago(endtime)
-          | where EventID == 4624 and LogonType == 10
-          | summarize make_set(Computer), ComputerCount = dcount(Computer) by bin(TimeGenerated, 1d), Account = tolower(Account), IpAddress
-          // Connection count to computer by same account and IP to exclude counts of 5 or more on a given day
-          | where ComputerCount >= threshold
-          | mvexpand set_Computer
-          | extend Computer = toupper(set_Computer)
-          ),
-          (
-          WindowsEvent
-          | where TimeGenerated >= ago(starttime) and TimeGenerated < ago(endtime)
-          | where EventID == 4624 and EventData has ("10")
-          | extend LogonType = tostring(EventData.LogonType)
-          | where LogonType == 10
-          | extend Account = strcat(tostring(EventData.TargetDomainName), "\\", tostring(EventData.TargetUserName))
-          | extend IpAddress = tostring(EventData.IpAddress)
-          | summarize make_set(Computer), ComputerCount = dcount(Computer) by bin(TimeGenerated, 1d), Account = tolower(Account), IpAddress
-          // Connection count to computer by same account and IP to exclude counts of 5 or more on a given day
-          | where ComputerCount >= threshold
-          | mvexpand set_Computer
-          | extend Computer = toupper(set_Computer)
-          ))
-      )
-      on
-      Account,
-      $left.SecondComputer == $right.Computer,
-      $left.SecondIPAddress == $right.IpAddress
+  Account,
+  FirstHop,
+  FirstComputer,
+  FirstComputerIP = ResolvedIP,
+  FirstRemoteIPAddress,
+  SecondHop,
+  SecondComputer,
+  SecondComputerIP = ResolvedIP1,
+  SecondRemoteIPAddress,
+  AccountType,
+  Activity,
+  LogonTypeName,
+  ProcessName
+  // Ensure the first connection is before the second connection
+  // Identify only RDP to another computer from within the first RDP connection by only choosing matches where the Computer names do not match
+  // Ensure the IPAddresses do not match by excluding connections from the same computers with first hop RDP connections to multiple computers
+  | where FirstComputer != SecondComputer
+  and FirstRemoteIPAddress != SecondRemoteIPAddress
+  and SecondHop > FirstHop
+  // Ensure the second hop occurs within 30 minutes of the first hop
+  | where SecondHop <= FirstHop + 30m
+  | where SecondRemoteIPAddress == FirstComputerIP
   | summarize FirstHopFirstSeen = min(FirstHop), FirstHopLastSeen = max(FirstHop)
-      by
-      Account,
-      FirstComputer,
-      FirstIPAddress,
-      SecondHop,
-      SecondComputer,
-      SecondIPAddress,
-      AccountType,
-      Activity,
-      LogonTypeName,
-      ProcessName
+  by
+  Account,
+  FirstComputer,
+  FirstComputerIP,
+  FirstRemoteIPAddress,
+  SecondHop,
+  SecondComputer,
+  SecondComputerIP,
+  SecondRemoteIPAddress,
+  AccountType,
+  Activity,
+  LogonTypeName,
+  ProcessName
   | extend
-      AccountName = tostring(split(Account, @"\")[1]),
-      AccountNTDomain = tostring(split(Account, @"\")[0])
+  AccountName = tostring(split(Account, @"")[1]),
+  AccountNTDomain = tostring(split(Account, @"")[0])
   | extend
-      HostName1 = tostring(split(FirstComputer, ".")[0]),
-      DomainIndex = toint(indexof(FirstComputer, '.'))
+  HostName1 = tostring(split(FirstComputer, ".")[0]),
+  DomainIndex = toint(indexof(FirstComputer, '.'))
   | extend HostNameDomain1 = iff(DomainIndex != -1, substring(FirstComputer, DomainIndex + 1), FirstComputer)
   | extend
-      HostName2 = tostring(split(SecondComputer, ".")[0]),
-      DomainIndex = toint(indexof(SecondComputer, '.'))
+  HostName2 = tostring(split(SecondComputer, ".")[0]),
+  DomainIndex = toint(indexof(SecondComputer, '.'))
   | extend HostNameDomain2 = iff(DomainIndex != -1, substring(SecondComputer, DomainIndex + 1), SecondComputer)
   | project-away DomainIndex
 entityMappings:
@@ -218,7 +188,7 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: FirstIPAddress
-version: 1.2.7
+version: 1.2.8
 kind: Scheduled
 metadata:
     source: