Local Account RDP Login from External Network

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects RDP login attempts from an external network to the internal network. It specifically looks for the RDP protocol header (0x03 0x00) on TCP port 3389. A threshold of 5 attempts within 60 seconds from the same source IP is set to reduce false positives.