Analytics BIOC
Informational
✕
An uncommon RDP session was established
An RDP session was established with uncommon parameters.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Lateral Movement (TA0008)
ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001)
Detector tags: Enhanced RDP Analytics
Attacker's goals:
Adversaries may use RDP for initial access or lateral movement within a network.
Investigative actions:
Investigate the source and destination of the RDP communication. Check if this communication is legitimate and expected. Analyze the user and process that initiated the RDP connection.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
6 variations:
- An uncommon RDP session was established by an RMM actor Low (parent: Informational)
- An uncommon RDP session was established from a Suspicious Autonomous System (AS) Medium (parent: Informational)
- An uncommon RDP session was established originating from a chained RDP session which is also from a rare subnet Low (parent: Informational)
- An uncommon RDP session was established between subnets with no prior communication Low (parent: Informational)
- An uncommon RDP session was established involving subnets with no prior RDP history Low (parent: Informational)
- An uncommon RDP session was established involving a destination subnet which rarely receives incoming RDP sessions Low (parent: Informational)