RedVDS - Simultaneous Multi-Host RDP Pivoting
Detects simultaneous RDP connections to multiple internal hosts originating from a single compromised RedVDS gateway, indicating rapid lateral movement.
Microsoft Sentinel (KQL)
Detects simultaneous RDP connections to multiple internal hosts originating from a single compromised RedVDS gateway, indicating rapid lateral movement.
Already have an account?