RDP from an unmanaged endpoint in a typically managed subnet

Analytics BIOC Low

RDP from an unmanaged endpoint in a typically managed subnet

An RDP connection was established from an unmanaged endpoint in a typically managed subnet, indicating a possible lateral movement.

Module:: Platform Analytics
Data source:: Palo Alto Networks Firewall traffic Logs, XDR Agent

ATT&CK tactics: Lateral Movement (TA0008)

ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001)

Detector tags: Enhanced RDP Analytics

Attacker's goals:

Lateral movement to critical assets from an unmanaged host.

Investigative actions:

Verify if the source endpoint is authorized to perform RDP connections. Validate that the source endpoint is managed or unmanaged. Investigate the user account used for the RDP connection.

Test period:: N/A (single event)
Deduplication:: 1 Day

1 variation:

RDP from an unmanaged endpoint in a typically managed subnet with a significantly higher number of managed endpoints in the subnet Low