Analytics
Informational
✕
Multiple alerts associated with a single RDP connection
Multiple alerts associated with a single RDP connection were triggered.
- Module:
- Platform Analytics
- Data source:
- Palo Alto Networks Platform Alerts, Third-Party Alerts
ATT&CK tactics: Lateral Movement (TA0008)
ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001)
Detector tags: Enhanced RDP Analytics
Attacker's goals:
Adversaries may use RDP for initial access or lateral movement within a network.
Investigative actions:
Investigate the source and destination of the RDP communication. Check if this communication is legitimate and expected. Analyze the user and process that initiated the RDP connection.
- Test period:
- 3 Hours
- Deduplication:
- 1 Day