External Remote RDP Logon from Public IP

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•2•0•35

Detects successful RDP logons originating from public IP addresses. This can indicate an exposed RDP port being accessed externally, potentially by an attacker.