RDP Lateral Movement: Successful Logons from Unusual External Sources

Ankit Mehta@Secvyn

•updated 6 days ago•0•0•0

Detects successful RDP (Remote Desktop Protocol) logon events (Event ID 4624, Logon Type 10) where the source IP address is outside the predefined internal network ranges. This behavior is indicative of potential lateral movement, where an attacker attempts to access internal systems from an external, non-corporate source.