UNC1549: RDP logon (Type 10) between workstations post-credential dumping

Ibrahim Saud@tektrix

•updated Jul 2, 2026•1•0•4

This rule detects potential lateral movement by monitoring for successful Remote Desktop Protocol (RDP) logons (Event ID 4624, Logon Type 10) occurring directly between workstations, excluding connections where the destination computer name indicates a typical server or infrastructure naming convention (e.g., ends with $).