xrdp Unauthenticated Stack Buffer Overflow via RDP Connection Sequence (CVE-2025-68670)

union
  (
    DeviceNetworkEvents
    | where RemotePort == 3389 or LocalPort == 3389
    | where ActionType in ("InboundConnectionAccepted", "ConnectionSuccess")
    | project TimeGenerated, DeviceName, LocalIP, RemoteIP, RemotePort, LocalPort, InitiatingProcessFileName, InitiatingProcessCommandLine
  ),
  (
    Syslog
    | where ProcessName has "xrdp"
    | where SyslogMessage has_any ("error", "segfault", "stack", "overflow", "crash", "core dumped", "fatal", "abort")
    | project TimeGenerated, Computer, ProcessName, SyslogMessage
  ),
  (
    SecurityEvent
    | where EventID in (4624, 4625)
    | where LogonType == 10
    | project TimeGenerated, Computer, Account, IpAddress, LogonType, Status, SubStatus
  )
| where TimeGenerated >= ago(24h)
| sort by TimeGenerated desc

index=linux_logs (sourcetype=syslog OR sourcetype=linux_secure OR sourcetype=linux_messages)
(
  (process=xrdp* ("error" OR "segfault" OR "stack" OR "overflow" OR "crash" OR "core dumped" OR "fatal" OR "abort" OR "SIGSEGV" OR "SIGABRT"))
  OR
  (sourcetype=linux_secure dest_port=3389 action=success)
)
| eval event_type=case(
    match(_raw, "(?i)(segfault|overflow|SIGSEGV|SIGABRT|core dumped)"), "xrdp_crash",
    match(_raw, "(?i)(error|fatal|abort)"), "xrdp_error",
    dest_port=="3389", "rdp_connection",
    true(), "other"
  )
| stats count by _time, host, src_ip, dest_ip, event_type, _raw
| where count > 0
| sort - _time

sequence by host.name with maxspan=2m
  [network where destination.port == 3389 and network.direction == "ingress" and source.ip != "127.0.0.1"]
  [process where process.name like~ "xrdp*" and
    (
      event.action == "process_stopped" or
      process.exit_code != null and process.exit_code != 0 or
      process.title like~ "*(segfault|SIGSEGV|SIGABRT|core dumped|overflow)*"
    )
  ]

SELECT
  LOGSOURCENAME(logsourceid) AS log_source,
  "startTime",
  "sourceip",
  "destinationip",
  "destinationport",
  "username",
  "eventdirection",
  "Message"
FROM events
WHERE
  (
    ("destinationport" = 3389 AND "eventdirection" = 'R2L')
    OR
    (LOWER("Message") IMATCHES '.*xrdp.*(segfault|overflow|sigsegv|sigabrt|core dumped|stack smash|fatal error).*')
  )
  AND LOGSOURCETYPENAME(devicetype) IN ('LinuxServer', 'SyslogNGEE', 'Universal DSM', 'IBM Security Network Protection')
  AND "startTime" > (NOW() - 86400000)
ORDER BY "startTime" DESC
LIMIT 500

_sourceCategory=linux/syslog OR _sourceCategory=linux/secure
| where _raw matches /xrdp/
| where _raw matches /(?i)(segfault|SIGSEGV|SIGABRT|overflow|core dumped|fatal|crash|stack smash)/ OR _sourcePort="3389" OR _destinationPort="3389"
| parse regex "(?<src_ip>\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})" nodrop
| if(isNull(src_ip), "unknown", src_ip) as src_ip
| count by _sourceHost, src_ip, _raw
| sort by _count desc

rule cve_2025_68670_xrdp_stack_overflow {
  meta:
    author = "df00tech"
    description = "Detects potential exploitation of CVE-2025-68670 xrdp unauthenticated stack buffer overflow"
    severity = "CRITICAL"
    confidence = "MEDIUM"
    reference = "https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-rwvg-gp87-gh6f"

  events:
    (
      $network.metadata.event_type = "NETWORK_CONNECTION"
      $network.target.port = 3389
      $network.network.direction = "INBOUND"
      $network.principal.ip != "127.0.0.1"
    )
    or
    (
      $process.metadata.event_type = "PROCESS_UNCATEGORIZED"
      re.regex($process.principal.process.file.full_path, `.*xrdp.*`)
      re.regex($process.metadata.description, `(?i)(segfault|overflow|sigsegv|sigabrt|core dumped|fatal|crash)`)
    )

  condition:
    $network or $process
}

#event_simpleName IN ("NetworkConnectIP4", "NetworkConnectIP6", "ProcessRollup2", "SyntheticProcessRollup2")
| filter
  (
    (event_simpleName IN ("NetworkConnectIP4", "NetworkConnectIP6") AND RemotePort = "3389" AND NetworkDirectionName = "INBOUND")
    OR
    (event_simpleName IN ("ProcessRollup2", "SyntheticProcessRollup2") AND ImageFileName LIKE "%xrdp%" AND (ExitCode != "0" OR CommandLine LIKE "%core%"))
  )
| eval event_type=if(event_simpleName IN ("NetworkConnectIP4", "NetworkConnectIP6"), "rdp_inbound", "xrdp_abnormal_exit")
| stats count() by ComputerName, aid, RemoteAddressIP4, RemotePort, ImageFileName, ExitCode, event_type
| sort -count