medium
advisory
Detection of External RDP Logon from Public IP Addresses
This detection identifies successful Remote Desktop Protocol (RDP) logons originating from non-private IP addresses, which may indicate a publicly-exposed RDP port.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 5, 14:26 UTC
- Detection
- 1 rule
- Source quality
- A2Roughly even chance
Successful RDP logons (LogonType 10) from public IP addresses can indicate that a Windows host has a publicly-exposed RDP port.
False Positives
Legitimate or intentional inbound connections from public IP addresses on the RDP port.
Detection coverage 1
Detect Successful External Remote RDP Logon
mediumDetects successful logon from public IP address via RDP.
sigma
sources: windows, security
Detection queries are available on the platform. Get full rules →