RDP Lateral Movement: Interactive Logons to Multiple Hosts
Detects potential lateral movement by monitoring user accounts performing interactive RDP logons (LogonType 10) to multiple distinct internal hosts within a 15-minute window. Additionally, identifies RDP logons occurring outside of standard business hours (before 6 AM or after 8 PM), a pattern often associated with human-operated ransomware activity.
YARA-L
