Concurrent RDP Lateral Movement from Single Source to Multiple Hosts

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•3

Detects a single source IP address initiating Remote Desktop Protocol (Logon Type 10) connections to three or more distinct computer destinations within a 10-minute window. This behavior is indicative of lateral movement or internal network scanning activity.