Windows RDP Login Session Established

The analytic detects successful Remote Desktop Protocol (RDP) login sessions, identified by Windows Security Event ID 4624 with Logon Type 10. This indicates a user has successfully authenticated and established an interactive RDP session, which is a critical indicator of remote access to a Windows system. Correlating this with Event ID 1149 (RDP authentication success) helps differentiate between credential acceptance and actual session establishment.