ATT&CK T1021.001 - RDP Lateral Movement Attempt
This rule detects an attempt at RDP lateral movement by identifying multiple RDP connection attempts to a host within a short timeframe. It specifically looks for the RDP connection initiation sequence (hexadecimal content '|03 00 00|') on port 3389 (RDP default port) and triggers an alert if 5 such attempts are observed from the same source within 60 seconds. This behavior is indicative of an attacker trying to move laterally within a network using RDP.
Suricata
