🚀 CyberRDP Observer

CyberRDP Observer - A passive RDP traffic analyzer for security assessment and threat detection

✨ Features

Authentication Protocol Analysis

• Detect weak authentication methods (NTLMv1, RDP, etc.)
• Identify unencrypted authentication attempts
• Validate TLS/SSL certificate usage

Session Hijack Detection

• Detect abnormal sequence numbers
• Identify source IP changes mid-session
• Detect unencrypted sensitive data transmission

JIT Privilege Elevation Detection

• Identify privilege escalation attempts
• Detect common UAC bypass techniques
• Monitor for suspicious process creation

🔍 ML-Powered Anomaly Detection

• Behavioral analysis of RDP sessions using Isolation Forest
• Real-time anomaly scoring for suspicious activities
• User behavior profiling and deviation detection
• Automated baseline learning of normal traffic patterns

🚀 Getting Started

Prerequisites

• Python 3.8 or higher
• TShark (Wireshark command-line tools)
• Required Python packages (see requirements.txt)

Installation

1. Clone the repository:

   git clone https://github.com/yourusername/cyberrdp-observer.git
   cd cyberrdp-observer

2. Install the required dependencies:

   pip install -r requirements.txt

3. Make sure TShark is installed and in your system PATH.

🛠 Usage

Basic Usage

python -m rdp_observer.analyze -i <interface> -o <output_file>

Analyze a PCAP File

python -m rdp_observer.analyze -r <pcap_file> -o <output_file>

View Help

python -m rdp_observer.analyze --help

📂 Project Structure

.
├── analyzers/                  # Analysis modules
├── analysis_results/           # Analysis output files
│   ├── jit_analysis/          # JIT elevation analysis results
│   └── packet_analysis/       # General packet analysis results
├── config/                    # Configuration files
├── detection_rules/           # Detection rules and signatures
├── docs/                      # Documentation
├── examples/                  # Example scripts and usage
├── scripts/                   # Utility scripts
├── tests/                     # Test cases
└── rdp_observer/              # Main package source code
    ├── __init__.py
    ├── analyze.py             # Main analysis script
    └── utils/                 # Utility modules

📝 License

This project is licensed under the MIT License - see the LICENSE file for details.

🤝 Contributing

Contributions are welcome! Please read our Contributing Guidelines for details on how to contribute to this project.

📄 Documentation

For detailed documentation, please see the docs directory.

📧 Contact

For questions or support, please open an issue in the GitHub repository.