Ransomware Series: Anomalous RDP Lateral Movement Following Credential Compromise

Ibrahim Saud@tektrix

•updated 28 days ago•1•0•3

This rule detects potential identity-led lateral movement in two scenarios: 1) A single account performing RDP authentications to multiple distinct hosts within a short time frame (RDP Fan-Out), or 2) An RDP login occurring on a host shortly after evidence of LSASS process memory access on that same host, suggesting potential credential theft followed by immediate reuse.