Potential Remote Desktop Connection to Non-Domain Host via NTLM
Detects logons using NTLM to hosts that are potentially not part of the domain, specifically targeting Remote Desktop Protocol (RDP) connections. This could indicate an attempt to establish remote access to systems outside of the managed domain, potentially for lateral movement or persistence.
Sigma
