SIEM Visualization Example 3: Successful RDP Logon Related To Service Accounts

In this example, we will create a SIEM visualization to monitor successful Remote Desktop Protocol (RDP) logons specifically related to service accounts. Since service accounts typically have elevated privileges and are not intended for interactive use (e.g., RDP logons), monitoring such activity can help detect potential misuse or compromise of these accounts.

---

Step 1: Accessing the Dashboard

1. Spawn the Target System:

   • Navigate to the bottom of the section and click on "Click here to spawn the target system!".

2. Access Kibana:

   • Open your browser and navigate to http://[Target IP]:5601.

   • Click on the side navigation toggle and select "Dashboard".

3. Edit the Prebuilt Dashboard:

   • A prebuilt dashboard should be visible. Click on the "pencil"/edit icon to modify it.

4. Create a New Visualization:

   • Click on "Create visualization" to begin building the new visualization.

---

Step 2: Configuring the Visualization

Key Elements to Configure

1. Filter Data:

   • Use the filter option to narrow down the data to only include successful RDP logons related to service accounts.

   • Add the following filters:

     • event.code: 4624 (Windows event ID for successful logons).

     • winlog.logon.type: RemoteInteractive (Indicates an RDP logon).

     • user.name: svc-* (Filters for service accounts that start with svc-).

2. Select the Index Pattern:

   • In the Index pattern field, specify windows* to focus on Windows-related logs.

3. Verify Fields:

   • Use the search bar to confirm the presence of fields like:

     • user.name.keyword (Username of the service account).

     • host.hostname.keyword (Machine where the logon occurred).

     • related.ip.keyword (IP address of the machine initiating the RDP logon).

4. Choose Visualization Type:

   • From the dropdown menu, select "Table" as the visualization type.

---

Step 3: Building the Table Visualization

1. Configure Rows:

   • Click on "Rows" and configure the following:

     • Field: user.name.keyword

     • Rank by: Alphabetical (or Count of records, if available).

   • Close the Rows window.

2. Add Metrics:

   • Click on "Metrics" and select "Count" as the metric.

   • The table will populate with data showing the count of successful RDP logons per service account.

3. Add Host Information:

   • Add two additional Rows settings to include:

     • Field: host.hostname.keyword (Machine where the logon occurred).

     • Field: related.ip.keyword (IP address of the machine initiating the RDP logon).

   • The table will now display four columns:

     • Service Account: Displays the usernames of service accounts.

     • Machine: Shows the hostname where the logon occurred.

     • Source IP: Displays the IP address of the machine initiating the RDP logon.

     • Successful Logon Attempts: Counts the number of successful RDP logons for each service account.

4. Save the Visualization:

   • Click on "Save and return" to add the visualization to the dashboard.

---

Step 4: Final Visualization

After completing the configuration, the final visualization will include:

1. Columns:

   • Service Account: The username of the service account generating the successful RDP logon event.

   • Machine: The hostname where the logon occurred.

   • Source IP: The IP address of the machine initiating the RDP logon.

   • Successful Logon Attempts: The count of successful RDP logons for each service account.

2. Filters:

   • Only events with event.code: 4624 (successful logons), winlog.logon.type: RemoteInteractive (RDP logons), and user.name: svc-* (service accounts) are included.

3. Sorting:

   • Sort the table by the count of successful logon attempts in descending order to prioritize accounts with the most activity.

---

Step 5: Review and Save

1. Review the Dashboard:

   • Navigate back to the Dashboard page to view the new visualization.

   • Ensure that the table displays accurate and actionable insights.

2. Save the Dashboard:

   • Click on the "Save" button to save your progress.

---

Key Takeaways

1. Monitor Service Account Usage:

   • Service accounts often have high privileges and are not intended for interactive use, such as RDP logons. Monitoring their usage helps detect potential misuse or compromise.

2. Leverage Event Logs:

   • The event.code: 4624 log provides critical information about successful logons, while the winlog.logon.type field helps identify RDP-specific activity.

3. Visualization Enhances Clarity:

   • Using a table visualization allows SOC analysts to quickly identify patterns, such as repeated RDP logons from specific IPs or machines.

4. Best Practices:

   • Use .keyword fields for aggregations to ensure accurate results.

   • Regularly refine filters to exclude irrelevant data and reduce noise.

   • Combine visualizations into dashboards for a comprehensive view of security events.

---

Example Use Case

• Scenario: An attacker gains access to a service account's credentials and uses them to log in via RDP. This generates events with event.code: 4624 and winlog.logon.type: RemoteInteractive.

• Action: The SOC team can use this visualization to:

  • Identify the source IP of the attacker.

  • Block malicious IPs or investigate compromised systems.

  • Strengthen security policies to prevent the misuse of service accounts.

By following these steps, you can create a robust visualization for monitoring successful RDP logons related to service accounts, enabling your SOC team to proactively detect and respond to potential threats.