CVE-2026-32105 & CVE-2026-32107: Debian LTS xrdp RDP Flaws — Detection, Exposure Reduction, and Patch Verification

---
title: Linux xrdp Process Spawning Shell or Execution Utility
id: 9b4c1f6a-2d7e-4a51-9d3c-7e21a0f5b8c2
status: experimental
description: Detects xrdp or xrdp-sesman spawning shells, script interpreters, downloaders, or tunneling tools, which can indicate post-exploitation after an RDP service compromise.
references:
  - https://linuxsecurity.com/advisories/deblts/debian-lts-dla-4759-1-xrdp
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1021/001/
author: Security Arsenal
date: 2026/04/24
tags:
  - attack.execution
  - attack.lateral_movement
  - attack.t1059
  - attack.t1021.001
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/xrdp'
      - '/xrdp-sesman'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
      - '/ssh'
      - '/scp'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Rare administrative automation explicitly wrapped around xrdp session startup
  - Custom session scripts that legitimately call a shell; review CommandLine and host role
level: high
---
title: Linux xrdp Unexpected Outbound Network Connection
id: 2c7a91d4-6f35-4b8a-ae18-5d0c6b9f4127
status: experimental
description: Detects xrdp initiating outbound connections to non-local destinations. xrdp normally accepts inbound RDP and communicates with local session components; Internet-bound egress from the daemon is suspicious.
references:
  - https://linuxsecurity.com/advisories/deblts/debian-lts-dla-4759-1-xrdp
  - https://attack.mitre.org/techniques/T1071/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/24
tags:
  - attack.command_and_control
  - attack.exfiltration
  - attack.t1071
  - attack.t1105
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith: '/xrdp'
    Initiated: 'true'
  filter_loopback:
    DestinationIp|startswith:
      - '127.'
      - '::1'
  filter_private:
    DestinationIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
  condition: selection and not 1 of filter_*
falsepositives:
  - Unusual integrations where xrdp is fronted by or brokers to external session infrastructure; document and allowlist by destination
level: medium

// Hunt xrdp crashes, restarts, suspicious children, and unexpected egress in Sentinel.
// Assumes Linux syslog via Syslog table and/or MDE for Linux process events.
let xr = @"xrdp|xrdp-sesman|xorgxrdp";
union isfuzzy=true
(
  Syslog
  | where TimeGenerated > ago(24h)
  | where ProcessName matches regex xr or SyslogMessage matches regex xr
  | where SeverityLevel in (@"err", @"crit", @"alert", @"emerg")
     or SyslogMessage has_any (@"segfault", @"core dumped", @"stack smashing", @"buffer", @"tls alert", @"handshake failure", @"connection reset")
  | project TimeGenerated, Computer, HostName, ProcessName, SeverityLevel, SyslogMessage
),
(
  DeviceProcessEvents
  | where TimeGenerated > ago(24h)
  | where InitiatingProcessFileName has_any (@"xrdp", @"xrdp-sesman")
     or (InitiatingProcessFileName has_any (@"xrdp", @"xrdp-sesman") and FileName has_any (@"sh", @"bash", @"dash", @"python", @"python3", @"perl", @"curl", @"wget", @"nc", @"ncat", @"socat", @"ssh", @"scp", @"base64"))
  | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, RemoteIP, RemotePort
),
(
  DeviceNetworkEvents
  | where TimeGenerated > ago(24h)
  | where InitiatingProcessFileName has_any (@"xrdp", @"xrdp-sesman")
  | where ActionType == @"ConnectionSuccess"
  | where not (RemoteIP startswith @"127." or RemoteIP == @"::1" or RemoteIP startswith @"10." or RemoteIP startswith @"192.168." or (RemoteIP startswith @"172." and toint(split(RemoteIP, @".")[1]) between (16 .. 31)))
  | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl
)
| order by TimeGenerated desc

-- Velociraptor hunt: inventory xrdp listeners, processes, and suspicious daemon children.
-- Run on Linux endpoints where xrdp may be installed; review before broad deployment.
SELECT * FROM foreach(
  row={
    SELECT Name, Pid, Ppid, Exe, CommandLine, Username, CreateTime
    FROM pslist()
    WHERE Name =~ 'xrdp|xrdp-sesman' OR CommandLine =~ 'xrdp|xorgxrdp'
  },
  query={
    SELECT Name, Pid, Ppid, Exe, CommandLine, Username, CreateTime
    FROM scope()
  })
UNION ALL
SELECT Name = 'netstat', Pid = Pid, Ppid = 0, Exe = '',
       CommandLine = format(format='%v %v:%v -> %v:%v %v', args=[Protocol, LocalAddr.IP, LocalAddr.Port, RemoteAddr.IP, RemoteAddr.Port, Status]),
       Username = '', CreateTime = now()
FROM netstat()
WHERE (LocalAddr.Port = 3389 OR Process =~ 'xrdp')

#!/usr/bin/env bash
# xrdp DLA-4759-1 triage, patch, and exposure verification for Debian LTS hosts.
# Set MGMT_CIDR to your approved admin/VPN range before enforcing firewall rules.
set -euo pipefail
MGMT_CIDR="CHANGE_ME/32"

say(){ printf '[*] %s\n' "$*"; }

say "Host and package state"
hostnamectl || true
dpkg -l | awk '/^(ii|hi)/ && ($2 ~ /^(xrdp|xorgxrdp)$/){print $1, $2, $3}' || true
apt-cache policy xrdp xorgxrdp || true

say "Refreshing metadata and upgrading xrdp packages if available"
export DEBIAN_FRONTEND=noninteractive
apt-get update
apt-get install --only-upgrade -y xrdp xorgxrdp || true

say "Post-update package state"
dpkg -l | awk '/^(ii|hi)/ && ($2 ~ /^(xrdp|xorgxrdp)$/){print $1, $2, $3}' || true

say "Restarting and validating service state"
systemctl daemon-reload || true
systemctl restart xrdp || true
systemctl --no-pager --full status xrdp || true
ss -ltnp | awk 'NR==1 || /:3389/'

say "Recent crash and integrity indicators"
journalctl -u xrdp -u xrdp-sesman --since "-72h" --no-pager | egrep -i 'segfault|core dumped|stack smashing|buffer|tls alert|handshake|reset|error|crit' || true
dmesg -T | egrep -i 'xrdp|segfault|trap|general protection' || true
ls -lah /var/crash /var/lib/apport/coredump /var/lib/systemd/coredump 2>/dev/null || true

say "Exposure check: do not leave 3389 open to untrusted networks"
if command -v ufw >/dev/null 2>&1; then
  ufw status verbose || true
  if [ "${MGMT_CIDR}" != "CHANGE_ME/32" ]; then
    ufw deny 3389/tcp || true
    ufw allow from "${MGMT_CIDR}" to any port 3389 proto tcp || true
    ufw status numbered || true
  else
    say "MGMT_CIDR not set; firewall not modified."
  fi
fi

say "If xrdp is not required, disable and mask it"
say "Run manually only after owner approval: systemctl disable --now xrdp xrdp-sesman && systemctl mask xrdp"