Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters.

Download CSV Show ATT&CK heatmap
  • An uncommon RDP session from a managed host Informational 5 variations

    An RDP session was established with uncommon parameters from a managed host.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Lateral Movement (TA0008)
    ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001)
    Required data: XDR Agent
    Detector tags: Enhanced RDP Analytics
    Attacker's goals: Adversaries may use RDP for initial access or lateral movement within a network.
    Investigative actions: Investigate the source and destination of the RDP communication. Check if this communication is legitimate and expected. Analyze the user and process that initiated the RDP connection.

    Variations

    An uncommon RDP session initiated by a chained RDP client

    Low overridden

    An RDP session was established by a process that is itself an RDP client, which is uncommon behavior. overridden

    An uncommon RDP session initiated by a globally rare RDP client

    Low overridden

    An RDP session was established by a process hash that has not been seen globally, which is uncommon. overridden

    An uncommon RDP session initiated by a rare RDP client

    Low overridden

    An RDP session was established by a process hash that is rare in the environment. overridden

    An uncommon RDP session from a host that rarely initiates RDP

    Low overridden

    An RDP session was initiated from a host that does not typically establish RDP connections. overridden

    An uncommon RDP session initiated by a process with rare causality

    Low overridden

    An RDP session was established by a process with an uncommon parent process relationship. overridden