Publicly Accessible RDP Service
This rule detects connections to an RDP listener where the source IP address is not a private or link-local IP address. This indicates that the RDP service is publicly accessible from the internet, which is generally not recommended due to security risks.
Sigma
