Potential RDP Hijacking
This rule is designed to detect potential RDP session hijacking activity within the environment. RDP session hijacking occurs when an existing Remote Desktop session is taken over or reassigned without initiating a new authentication process. Monitoring this behavior helps identify suspicious attempts to interact with or assume control of active remote sessions.
Microsoft Sentinel (KQL)
