Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters.

Download CSV Show ATT&CK heatmap
  • An uncommon RDP session was established Informational 6 variations

    An RDP session was established with uncommon parameters.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Lateral Movement (TA0008)
    ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001)
    Required data: XDR Agent
    Detector tags: Enhanced RDP Analytics
    Attacker's goals: Adversaries may use RDP for initial access or lateral movement within a network.
    Investigative actions: Investigate the source and destination of the RDP communication. Check if this communication is legitimate and expected. Analyze the user and process that initiated the RDP connection.

    Variations

    An uncommon RDP session was established by an RMM actor

    Low overridden

    An RDP session was established with uncommon parameters. The session was initiated under a Remote Monitoring & Management CGO. overridden

    An uncommon RDP session was established from a Suspicious Autonomous System (AS)

    Medium overridden

    An RDP session was established with uncommon parameters. overridden

    An uncommon RDP session was established originating from a chained RDP session which is also from a rare subnet

    Low overridden

    An RDP session was established with uncommon parameters. The connection appears to originate from an endpoint that itself received an RDP connection, suggesting a chained session. overridden

    An uncommon RDP session was established between subnets with no prior communication

    Low overridden

    An RDP session was established with uncommon parameters. The source and destination subnets have not been observed communicating with each other previously. overridden

    An uncommon RDP session was established involving subnets with no prior RDP history

    Low overridden

    An RDP session was established with uncommon parameters. Neither the source nor the destination subnet has been observed participating in RDP sessions previously. overridden

    An uncommon RDP session was established involving a destination subnet which rarely receives incoming RDP sessions

    Low overridden

    An RDP session was established with uncommon parameters. The destination subnet is rarely involved in RDP activity. overridden