Analytics BIOC Informational
✕

An uncommon RDP session from a managed host

An RDP session was established with uncommon parameters from a managed host.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Lateral Movement (TA0008)
ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001)
Detector tags: Enhanced RDP Analytics
Attacker's goals:

Adversaries may use RDP for initial access or lateral movement within a network.

Investigative actions:

Investigate the source and destination of the RDP communication. Check if this communication is legitimate and expected. Analyze the user and process that initiated the RDP connection.

Test period:
N/A (single event)
Deduplication:
1 Day
5 variations:
  • An uncommon RDP session initiated by a chained RDP client Low (parent: Informational)
  • An uncommon RDP session initiated by a globally rare RDP client Low (parent: Informational)
  • An uncommon RDP session initiated by a rare RDP client Low (parent: Informational)
  • An uncommon RDP session from a host that rarely initiates RDP Low (parent: Informational)
  • An uncommon RDP session initiated by a process with rare causality Low (parent: Informational)