RDP and Shells

Saryarka Telecom JSC is a regional telecom operator. You have been asked to write detection rules for the SIEM. The format is Sigma: a common language later translated into any system's query.

The day's data is deliberately mixed. Next to the events you need to catch lie similar but legitimate ones: administrators use RDP from the office, services are installed from Program Files, people are added to ordinary groups. A rule that catches everything is a bad rule.

Every rule is run against this data as soon as you submit it. You will see how many target events it caught and how many extra ones it hit. It passes when everything is caught and nothing extra. Refine and resubmit — attempts are unlimited.

A reference shape: title: Name logsource: product: windows detection: selection: event.code: 4624 filter: source.ip|startswith: '10.' condition: selection and not filter