High Volume RDP Connections from a Single Account

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•3

This rule detects when a single account initiates 5 or more successful Remote Desktop Protocol (RDP) connections within a one-hour window. This behavior can be indicative of an adversary attempting to gain widespread access within a network, potentially through credential stuffing, brute-force attacks, or lateral movement using compromised credentials.