Outbound RDP Connections Over Non-Standard Tools
Detects non-standard tools initiating outbound connections over port 3389, which is commonly used for Remote Desktop Protocol (RDP). This activity can indicate possible lateral movement within a network. The rule filters out legitimate RDP clients and other known third-party tools to reduce false positives. An initial baseline of legitimate RDP tooling is required for effective use.
Sigma
