Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0008 ✕ technique: T1021 ✕

Download CSV Show ATT&CK heatmap
  • RDP from an unmanaged endpoint in a typically managed subnet Low 1 variation

    An RDP connection was established from an unmanaged endpoint in a typically managed subnet, indicating a possible lateral movement.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Lateral Movement (TA0008)
    ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001)
    Required data: Palo Alto Networks Firewall traffic Logs XDR Agent
    Detector tags: Enhanced RDP Analytics
    Attacker's goals: Lateral movement to critical assets from an unmanaged host.
    Investigative actions: Verify if the source endpoint is authorized to perform RDP connections. Validate that the source endpoint is managed or unmanaged. Investigate the user account used for the RDP connection.

    Variations

    RDP from an unmanaged endpoint in a typically managed subnet with a significantly higher number of managed endpoints in the subnet

    Low overridden

    An RDP connection was established from an unmanaged endpoint in a typically managed subnet, indicating a possible lateral movement. The source subnet has a significantly higher number of managed endpoints compared to the unmanaged ones. overridden