RDP Logon (Type 10) Indicative of Lateral Movement

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•3

This rule detects interactive RDP logons (Logon Type 10) on Windows systems. While RDP is a legitimate remote administration tool, it is frequently abused by adversaries following credential theft to move laterally within a network.