Suspicious successful RDP connection to localhost

Cortex XSIAM Analytics Alert Reference by Alert name

Product
Cortex XSIAM
Last date published
2025-11-12
Category
Analytics Alert Reference
Index by
Alert name

Synopsis

Activation Period

14 Days

Training Period

30 Days

Test Period

N/A (single event)

Deduplication Period

1 Day

Required Data

  • Requires:
    • XDR Agent

Detection Modules

Identity Analytics

Detector Tags

ATT&CK Tactic

Initial Access (TA0001)

ATT&CK Technique

External Remote Services (T1133)

Severity

Informational

Description

An unusual process created a successful RDP connection to localhost. This may indicate the use of a tunnel to bypass a firewall.

Attacker's Goals

The attacker attempts to gain access to the accounts through RDP from an external source.

Investigative actions

  • Investigate the actor process to determine if it was used for legitimate purposes or malicious activity.
  • Identify the user performing RDP and check that it is authorized.
  • Follow further actions done by the user.

Variations

Suspicious successful RDP connection to localhost via reverse SSH tunnel

Synopsis

ATT&CK Tactic

Initial Access (TA0001)

ATT&CK Technique

External Remote Services (T1133)

Severity

Low

Description

An unusual process created a successful RDP connection to localhost.
The command line indicates the usage of SSH tunnel to bypass the firewall.

Attacker's Goals

The attacker attempts to gain access to the accounts through RDP from an external source.

Investigative actions

  • Investigate the actor process to determine if it was used for legitimate purposes or malicious activity.
  • Identify the user performing RDP and check that it is authorized.
  • Follow further actions done by the user.


Suspicious successful RDP connection to localhost on DC server

Synopsis

ATT&CK Tactic

Initial Access (TA0001)

ATT&CK Technique

External Remote Services (T1133)

Severity

Low

Description

An unusual process created a successful RDP connection to localhost on a DC server. This may indicate the use of a tunnel to bypass a firewall.

Attacker's Goals

The attacker attempts to gain access to the accounts through RDP from an external source.

Investigative actions

  • Investigate the actor process to determine if it was used for legitimate purposes or malicious activity.
  • Identify the user performing RDP and check that it is authorized.
  • Follow further actions done by the user.