Qilin Ransomware RDP Lateral Movement via Compromised Credentials

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•5

This rule detects potential lateral movement or account compromise by identifying instances where a single user account successfully logs into four or more unique computer systems via Remote Desktop (Logon Type 10) within a 30-minute window.