Successful RDP Connection Detection

Subash Ghimire@iamsubashg

•updated Aug 20, 2025•3•0•126

This rule detects successful Remote Desktop Protocol (RDP) connections by monitoring network events where the remote port is 3389 and the connection action type is 'ConnectionSuccess'. It aims to identify potential unauthorized access, lateral movement, or audit remote administration practices.