Skip to content

Hide Navigation Hide TOC

External Remote RDP Logon from Public IP (259a9cdf-c4dd-4fa2-b243-2269e5ab18a2)

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

Cluster A Galaxy A Cluster B Galaxy B Level
External Remote RDP Logon from Public IP (259a9cdf-c4dd-4fa2-b243-2269e5ab18a2) Sigma-Rules External Remote Services - T1133 (10d51417-ee35-4589-b1ff-b6df1c334e8d) Attack Pattern 1
External Remote RDP Logon from Public IP (259a9cdf-c4dd-4fa2-b243-2269e5ab18a2) Sigma-Rules Valid Accounts - T1078 (b17a1a56-e99c-403c-8948-561df0cffe81) Attack Pattern 1
External Remote RDP Logon from Public IP (259a9cdf-c4dd-4fa2-b243-2269e5ab18a2) Sigma-Rules Brute Force - T1110 (a93494bb-4b80-4ea1-8695-3236a49916fd) Attack Pattern 1