Device Detect RDP Recon
Query
//Search for devices connecting to multiple IP addresses via RDP witin a time window and alert when over a particular threshold
//Data connector required for this query - M365 Defender - Device* tables
let timerange=1d;
let window=20m;
let threshold=5;
DeviceNetworkEvents
| where TimeGenerated > ago(timerange)
| where ActionType == "ConnectionSuccess"
| where RemotePort == "3389"
// Exclude Defender for Identity which uses RDP to map your network
| where InitiatingProcessFileName <> "Microsoft.Tri.Sensor.exe"
| summarize ['Target Device List']=make_set(RemoteIP), ['Count of Devices']=dcount(RemoteIP) by bin(TimeGenerated, window), DeviceName
| where ['Count of Devices'] > threshold
| sort by ['Count of Devices'] descExplanation
This query is designed to monitor and alert on unusual Remote Desktop Protocol (RDP) activity from devices within a network. Here's a simplified explanation of what it does:
-
Time Frame: It looks at data from the past day (
1d). -
Activity Window: It examines connections in 20-minute intervals.
-
Threshold: It focuses on devices that connect to more than 5 different IP addresses via RDP within each 20-minute window.
-
Data Source: The query uses data from Microsoft 365 Defender, specifically from tables related to device network events.
-
Filtering Criteria:
- It only considers successful connection attempts (
ActionType == "ConnectionSuccess"). - It specifically looks at connections made to port 3389, which is commonly used for RDP.
- It excludes connections initiated by "Microsoft.Tri.Sensor.exe" to avoid false positives from legitimate network mapping activities by Defender for Identity.
- It only considers successful connection attempts (
-
Summarization:
- For each device, it compiles a list of unique IP addresses it has connected to within each 20-minute window.
- It counts how many different IP addresses each device has connected to.
-
Alert Condition: If a device connects to more than 5 different IP addresses in a 20-minute window, it triggers an alert.
-
Output: The results are sorted to show devices with the highest number of connections first.
This query helps identify potentially suspicious behavior, such as a device making numerous RDP connections in a short period, which could indicate a security risk.
Details
Matt Zorich
Released: June 17, 2022
Tables
Keywords
Operators