Analytics Alerts
Browse the Cortex analytics alert reference.
2 alerts match the current filters. tactic: TA0008 ✕ technique: T1021 ✕
Download CSV Show ATT&CK heatmapAbnormal RDP connections to multiple hosts Informational 1 variation
The endpoint attempted to initiate rare RDP connections to multiple hosts.
- Activation:
- 14 Days
- Training:
- 30 Days
- Test:
- 5 Hours
- Deduplication:
- 1 Day
ATT&CK tactics: Lateral Movement (TA0008)ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001)Required data: XDR AgentDetector tags: NDR Lateral Movement Analytics, Enhanced RDP AnalyticsAttacker's goals: Attackers may attempt to move laterally across the network by using compromised accounts or machines to connect to remote hosts via the RDP protocol.Investigative actions: Inspect the legitimacy of the user initiating the RDP connections. Verify that this activity is not part of routine IT operations.Variations
Abnormal RDP connections to multiple hosts
Low overridden
The endpoint attempted to initiate rare RDP connections to multiple hosts. overridden
Abnormal RDP connections to multiple hosts from a rarely seen host Low
The endpoint attempted to initiate rare RDP connections to multiple hosts.
- Activation:
- 14 Days
- Training:
- 30 Days
- Test:
- 5 Hours
- Deduplication:
- 1 Day
ATT&CK tactics: Lateral Movement (TA0008)ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001)Required data: XDR AgentDetector tags: NDR Lateral Movement Analytics, Enhanced RDP Analytics, NDR Unmanaged Subnet AnalyticsAttacker's goals: Attackers may attempt to move laterally across the network by using compromised accounts or machines to connect to remote hosts via the RDP protocol.Investigative actions: Inspect the legitimacy of the user initiating the RDP connections. Verify that this activity is not part of routine IT operations.