Skip to content

[Rule Tuning] RDP (Remote Desktop Protocol) from the Internet#5932

Open
eric-forte-elastic wants to merge 17 commits intomainfrom
5507-rule-tuning-rdp-remote-desktop-protocol-from-the-internet-8c1bdde8-4204-45c0-9e0c-c85ca3902488
Open

[Rule Tuning] RDP (Remote Desktop Protocol) from the Internet#5932
eric-forte-elastic wants to merge 17 commits intomainfrom
5507-rule-tuning-rdp-remote-desktop-protocol-from-the-internet-8c1bdde8-4204-45c0-9e0c-c85ca3902488

Conversation

@eric-forte-elastic
Copy link
Copy Markdown
Contributor

@eric-forte-elastic eric-forte-elastic commented Apr 8, 2026 •
edited
Loading

Pull Request

Issue link(s):

Resolves #5507

Summary - What I changed

Note

#5922 should be merged first

Small logical change to update this rule to ES|QL and use cidr_match instead of KQL comparison. KQL's CIDR syntax (source.ip: 10.0.0.0/8) only performs actual subnet matching when the Elasticsearch field mapping is ip type. Across mixed index patterns (packetbeat-, auditbeat-, filebeat-*, etc.), field types are not guaranteed. As such KQL silently falls back to a literal string comparison, so source.ip: 10.0.0.0/8 would never match a real IP address like 10.1.0.123

One can verify this in telemetry using source/dest ip address filtering. Furthermore, one can verify that the integrations used all use either ECS mappings (where source and dest are of type ip) or directly map to ip.

Also needed to update datastreams for Zeek integration reformat:

image

Given that this issue affects additional rules, 4 additional rules have been tuned with similar updates in this PR. The rule rules/network/initial_access_smb_windows_file_sharing_activity_to_the_internet.toml is left as it is due to it being a new_terms rule with additional tuning implications that are separate from these rules. Tuning that rule will be done as part of #4268 which will include additional data sources.

Additional rule modifications adding "Zeek" as an integration are required due to the integrations update adding Zeek.

How To Test

Verify in Telemetry.

Checklist

  • Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
  • Added the meta:rapid-merge label if planning to merge within 24 hours
  • Secret and sensitive material has been managed correctly
  • Automated testing was updated or added to match the most common scenarios
  • Documentation and comments were added for features that require explanation

Contributor checklist

@eric-forte-elastic eric-forte-elastic self-assigned this Apr 8, 2026
@eric-forte-elastic eric-forte-elastic added Domain: Network Rule: Tuning tweaking or tuning an existing rule labels Apr 8, 2026
@eric-forte-elastic eric-forte-elastic linked an issue Apr 8, 2026 that may be closed by this pull request
[Rule Tuning] RDP (Remote Desktop Protocol) from the Internet (8c1bdde8-4204-45c0-9e0c-c85ca3902488) #5507
Open
@eric-forte-elastic
Merge branch 'main' into 5507-rule-tuning-rdp-remote-desktop-protocol…
ca3be17 
…-from-the-internet-8c1bdde8-4204-45c0-9e0c-c85ca3902488
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 8, 2026

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

  • Detailed description of the suggested changes.
  • Provide example JSON data or screenshots.
  • Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
  • Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
  • Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
  • Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
  • Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
  • Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
  • Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
  • Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
  • Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
  • Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

  • updated_date matches the date of tuning PR merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

  • Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
  • Ensure that the tuned rule has a low false positive rate.

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Apr 8, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ RDP (Remote Desktop Protocol) from the Internet (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@eric-forte-elastic
Add keep
53b17c4
@eric-forte-elastic
Merge branch '5507-rule-tuning-rdp-remote-desktop-protocol-from-the-i…
0664b1e 
…nternet-8c1bdde8-4204-45c0-9e0c-c85ca3902488' of https://github.com/elastic/detection-rules into 5507-rule-tuning-rdp-remote-desktop-protocol-from-the-internet-8c1bdde8-4204-45c0-9e0c-c85ca3902488
@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Apr 8, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ RDP (Remote Desktop Protocol) from the Internet (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Apr 8, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ RDP (Remote Desktop Protocol) from the Internet (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Apr 8, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ RDP (Remote Desktop Protocol) from the Internet (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Apr 8, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ RDP (Remote Desktop Protocol) from the Internet (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMB (Windows File Sharing) Activity to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Apr 8, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ RDP (Remote Desktop Protocol) from the Internet (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMB (Windows File Sharing) Activity to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Apr 8, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ RDP (Remote Desktop Protocol) from the Internet (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMB (Windows File Sharing) Activity to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Apr 8, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Abnormally Large DNS Response (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RDP (Remote Desktop Protocol) from the Internet (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMB (Windows File Sharing) Activity to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMTP on Port 26/TCP (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Apr 8, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Abnormally Large DNS Response (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RDP (Remote Desktop Protocol) from the Internet (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMB (Windows File Sharing) Activity to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMTP on Port 26/TCP (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Apr 8, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Abnormally Large DNS Response (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) to the Internet (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RDP (Remote Desktop Protocol) from the Internet (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMB (Windows File Sharing) Activity to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMTP on Port 26/TCP (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Apr 8, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Abnormally Large DNS Response (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) to the Internet (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RDP (Remote Desktop Protocol) from the Internet (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMB (Windows File Sharing) Activity to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMTP on Port 26/TCP (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Apr 8, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Abnormally Large DNS Response (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) to the Internet (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RDP (Remote Desktop Protocol) from the Internet (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMB (Windows File Sharing) Activity to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMTP on Port 26/TCP (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Apr 8, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Abnormally Large DNS Response (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) to the Internet (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RDP (Remote Desktop Protocol) from the Internet (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMB (Windows File Sharing) Activity to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMTP on Port 26/TCP (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Apr 8, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Abnormally Large DNS Response (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) to the Internet (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RDP (Remote Desktop Protocol) from the Internet (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMB (Windows File Sharing) Activity to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMTP on Port 26/TCP (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@eric-forte-elastic eric-forte-elastic marked this pull request as ready for review April 9, 2026 15:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Mikaayenson Mikaayenson Awaiting requested review from Mikaayenson Mikaayenson is a code owner

@w0rk3r w0rk3r Awaiting requested review from w0rk3r

@Aegrah Aegrah Awaiting requested review from Aegrah

@shashank-elastic shashank-elastic Awaiting requested review from shashank-elastic

@terrancedejesus terrancedejesus Awaiting requested review from terrancedejesus

@DefSecSentinel DefSecSentinel Awaiting requested review from DefSecSentinel

At least 2 approving reviews are required to merge this pull request.

Assignees

@eric-forte-elastic eric-forte-elastic

Labels

backport: auto Domain: Network Integration: Network Traffic integration: PANW integration: Zeek patch Rule: Tuning tweaking or tuning an existing rule

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Rule Tuning] RDP (Remote Desktop Protocol) from the Internet (8c1bdde8-4204-45c0-9e0c-c85ca3902488)

2 participants

@eric-forte-elastic @tradebot-elastic