Akira: RDP Lateral Movement to Backup and File Servers with Compromised Accounts

Ibrahim Saud@tektrix

•updated Jun 29, 2026•2•0•6

Detects Remote Desktop (RDP) logon events (LogonType 10) initiated by common privileged or service-oriented accounts such as administrator, backup_EA, or backup_DA. This behavior may indicate unauthorized remote access or credential abuse using highly privileged accounts.