RDP Brute Force Followed by Successful Logon from Same IP
Detects a remote source IP address generating a high volume of failed Remote Desktop Protocol (RDP) logon attempts across multiple Windows hosts, followed by a successful RDP logon from the same source IP.
Microsoft Sentinel (KQL)
