Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2025-68670.
Upgrade to ProDetect xrdp Unauthenticated Stack Buffer Overflow via RDP Connection Sequence (CVE-2025-68670) in Microsoft Sentinel
CVE-2025-68670 is a critical unauthenticated stack buffer overflow (CWE-121) in xrdp versions prior to 0.10.5. During the RDP connection sequence, a remote unauthenticated attacker can send a specially crafted packet that overflows a stack buffer, potentially enabling remote code execution as the xrdp process user. CVSS 9.1. A public PoC exists. Patch to xrdp >= 0.10.5 immediately.
MITRE ATT&CK
- Tactic
- Initial Access Execution
KQL Detection Query
union
(
DeviceNetworkEvents
| where RemotePort == 3389 or LocalPort == 3389
| where ActionType in ("InboundConnectionAccepted", "ConnectionSuccess")
| project TimeGenerated, DeviceName, LocalIP, RemoteIP, RemotePort, LocalPort, InitiatingProcessFileName, InitiatingProcessCommandLine
),
(
Syslog
| where ProcessName has "xrdp"
| where SyslogMessage has_any ("error", "segfault", "stack", "overflow", "crash", "core dumped", "fatal", "abort")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
),
(
SecurityEvent
| where EventID in (4624, 4625)
| where LogonType == 10
| project TimeGenerated, Computer, Account, IpAddress, LogonType, Status, SubStatus
)
| where TimeGenerated >= ago(24h)
| sort by TimeGenerated descDetects potential exploitation of CVE-2025-68670 by correlating inbound RDP connections on port 3389 with xrdp process crash/error logs and RDP logon events. Anomalous connection patterns from external IPs followed by xrdp errors strongly indicate exploitation attempts.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate RDP connections from administrators or remote workers triggering benign xrdp log noise
- System resource pressure causing xrdp crashes unrelated to exploitation
- Automated vulnerability scanners performing RDP fingerprinting
- Misconfigured RDP clients sending malformed handshake packets
Other platforms for CVE-2025-68670
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1xrdp Version Enumeration via RDP Banner Grab
Expected signal: Network connection event to port 3389 from scanning host; xrdp access log entry for the probe connection.
- Test 2Malformed RDP X.224 PDU Fuzzing (PoC Simulation)
Expected signal: xrdp crash log entry (SIGSEGV/SIGABRT/stack smashing detected) in /var/log/xrdp.log; core dump if ulimit -c unlimited is set; network connection event from test host to port 3389.
- Test 3Post-Exploitation Persistence Check (Simulated RCE Artifact)
Expected signal: Auditd events for crontab modification by xrdp user; file creation event in /tmp for .xrdp_persist; process execution telemetry showing crontab -r invoked by non-interactive xrdp session.
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2025-68670 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month