Denied Access To Remote Desktop
This rule detects when an authenticated user, who is not authorized for remote logon, attempts to connect to a computer via Remote Desktop. This event can indicate an attacker attempting to discover and access available Windows servers on the network.
Sigma
