Successive RDP logons across multiple hosts by same user (lateral movement)

Ibrahim Saud@tektrix

•updated Jul 2, 2026•2•0•4

Detects a single user account authenticating via RDP (Logon Type 10) to three or more distinct target hosts within a 15-minute window, which is often indicative of an adversary performing lateral movement using compromised credentials.