@willemdh (WillemDH) posted a new topic, subject "RDP from Internet rule triggering on bogon ip address". It read:

   Hello,
    
    Noticed the SIEM rule" RDP (Remote Desktop Protocol) from the Internet" triggered on `source.ip: "747.597.8861"` which is a bogon link-local address.
    
    So this should not be considered as "from the Internet" and so "747.597.8861/16" should be excluded in the query?
    
    `event.category:(network or network_traffic) and network.transport:tcp and (destination.port:3389 or event.dataset:zeek.rdp) and not source.ip:747.597.8861/8 or 747.597.8861/12 or 747.597.8861/16) and destination.ip:747.597.8861/8 or 747.597.8861/8 or 747.597.8861/12 or 747.597.8861/16 or "8b7c:f320:99b9:690f:4595:cd17:293a:c069")`
    
    Grtz
    
    Willem

After which, @Mike_Paquette (Mike Paquette) added

    Hi Willem, thanks for submitting this rule improvement suggestion!
    
    I've created an issue in our public detection-rules repo, passing along your suggested improvement  
    
    
    github.com/elastic/detection-rules
    
    ####  [Rule Tuning] command_and_control_rdp_remote_desktop_protocol_from_the_internet.toml
    
    opened 10:30AM - 26 Oct 20 UTC
    
    MikePaquette 
    
    Origin Submitted to discuss forum on 26-Oct-2020 by @willemdh Description Noticed the SIEM rule" RDP (Remote Desktop Protocol) from the Internet" triggered on source.ip:...
    
    Rule: Tuning
    
    BTW, you can create issues directly in that repo if you prefer, as it is a public repo!
    
    Thanks for your continued contributions to our community!

After which, @willemdh (WillemDH) added

    Mike_Paquette:
    
    > BTW, you can create issues directly in that repo if you prefer, as it is a public repo!
    
    Well it's kind of confusing, because sometimes when I create some GH issue, I get the message I need to create a forum post first...
    
    Anyway, thanks for creating the GH issue!
    
    By the way, the same consideration might be valid for other "from / to the Internet" rules.

Then @system (system) said

    This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.


{'source': 'discourse', 'url': 'https://discuss.elastic.co/t/rdp-from-internet-rule-triggering-on-bogon-ip-address/253269', 'title': 'RDP from Internet rule triggering on bogon ip address', 'views': 455, 'has_accepted_answer': False, 'word_count': 274, 'like_count': 0, 'reply_count': 1, 'participant_count': 2, 'posts': 4, 'tags': '', 'author': '@willemdh (WillemDH)', 'participants': '@willemdh (WillemDH), @Mike_Paquette (Mike Paquette), @system (system)', 'image_url': ['https://global.discourse-cdn.com/elastic/original/3X/5/e/5e37c6f950b63bc4bc10b9c6ddb5b24d9e5e9f58.png'], 'created_at': '2020-10-26T07:59:45.906Z', 'last_posted_at': '2020-11-23T10:53:49.152Z'}