Anomalous RDP Logon (Type 10) from Atypical Internal Host

Ibrahim Saud@tektrix

•updated Jul 2, 2026•5•0•28

This rule identifies accounts, hosts, and remote IP addresses associated with a high volume of Remote Desktop Protocol (RDP) logon activity, which may indicate brute-force attempts, credential stuffing, or anomalous remote access behavior.