VerdantBamboo: MSP Admin Credential Use from Unexpected External Source IP

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects successful remote logons (LogonType 3 or 10) to Windows systems using highly privileged accounts (admin, administrator, root, or service-specific accounts) where the source IP address is external to defined private network CIDR ranges. This pattern is indicative of potential unauthorized access or compromised credentials.