Potential Remote Desktop Connection to Non-Domain Host (ce5678bb-b9aa-4fb5-be4b-e57f686256ad)
Detects logons using NTLM to hosts that are potentially not part of the domain.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Potential Remote Desktop Connection to Non-Domain Host (ce5678bb-b9aa-4fb5-be4b-e57f686256ad) | Sigma-Rules | Remote Access Software - T1219 (4061e78c-1284-44b4-9116-73e4ac3912f7) | Attack Pattern | 1 |