Tag

Attack.t1133

1 brief RSS

Detection of External RDP Logon from Public IP Addresses

This detection identifies successful Remote Desktop Protocol (RDP) logons originating from non-private IP addresses, which may indicate a publicly-exposed RDP port.

attack.privilege-escalation attack.persistence attack.initial-access attack.credential-access attack.stealth attack.t1133 attack.t1078 attack.t1110

1r 56m ago