Logon via RDP or WMI by a user account followed by uncommon command execution, file manipulation, or lateral network connections.
| Data Component | Name | Channel |
|---|---|---|
| Logon Session Creation (DC0067) | WinEventLog:Security | EventCode=4624 (LogonType=10 or 3), EventCode=4648 |
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 |
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3 |
| Field | Description |
|---|---|
| TimeWindow | Correlation window between remote login and post-access activity |
| LogonUser | Limit to service accounts or privileged users for higher fidelity |
| RemoteHostList | Allowlisting known admin jumpboxes or deployment tools |
SSH session from new source IP followed by interactive shell or privilege escalation (e.g., sudo, su) and outbound lateral connection.
| Data Component | Name | Channel |
|---|---|---|
| Logon Session Creation (DC0067) | linux:syslog | sshd: Accepted password/publickey |
| Command Execution (DC0064) | auditd:SYSCALL | execve, USER_CMD |
| Field | Description |
|---|---|
| SourceIP | Limit to new/unexpected SSH source IPs |
| CommandList | Flag suspicious post-SSH command patterns |
Remote login via ARD or SSH followed by screensharingd process activity or modification of TCC-protected files.
| Data Component | Name | Channel |
|---|---|---|
| Logon Session Creation (DC0067) | macos:unifiedlog | eventMessage CONTAINS 'screensharingd' or 'AuthorizationRefCreate' |
| Process Creation (DC0032) | macos:osquery | process_events |
| Field | Description |
|---|---|
| RemoteService | Differentiate ARD vs SSH access patterns |
| TargetedPath | Tunable list of sensitive directories or TCC targets |
Use of cloud-based bastion or VM console session followed by commands that initiate outbound SSH or RDP sessions from the cloud instance to other environments.
| Data Component | Name | Channel |
|---|---|---|
| Logon Session Creation (DC0067) | AWS:CloudTrail | AWS ConsoleLogin, StartSession |
| Network Connection Creation (DC0082) | AWS:VPCFlowLogs | Outbound connections to port 22, 3389 |
| Field | Description |
|---|---|
| SourceAssetTag | Limit detection to cloud admin/bastion hosts |
| TargetPortList | Define critical remote service ports to flag |
vSphere API logins (vimService) or SSH to ESXi host followed by unauthorized shell commands or lateral remote logins from the ESXi host.
| Data Component | Name | Channel |
|---|---|---|
| Logon Session Creation (DC0067) | esxi:vmkernel | vim.fault.*, DCUI login, SSH shell |
| Command Execution (DC0064) | esxi:shell | Command execution trace |
| Field | Description |
|---|---|
| SessionType | Filter by DCUI, SSH, vSphere API |
| CommandPattern | Watch for remote access tool invocations (e.g., netcat, ssh) |