Lateral Movement via RDP (Event 4624 Logon Type 10 / mstsc.exe)

Ibrahim Saud@tektrix

•updated Jul 2, 2026•3•0•10

This rule detects successful Remote Desktop Protocol (RDP) logons (Event ID 4624 with Logon Type 10) and the execution of the Remote Desktop Connection client (mstsc.exe). It monitors for signs of remote interactive access to windows endpoints, which can indicate unauthorized access or legitimate administrative activity.