ATT&CK T1133 - RDP Access from External IP

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•5

This rule detects RDP access attempts from external IP addresses to the internal network ($HOME_NET) on port 3389. It uses a threshold of 3 connection attempts within 300 seconds from the same source IP to trigger an alert, indicating potential brute-force or reconnaissance activity targeting RDP services. The rule is classified under the MITRE ATT&CK technique T1133, which involves 'Remote Desktop Protocol' for initial access.