Attack.t1133 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/attack.t1133/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 14:26:12 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDetection of External RDP Logon from Public IP Addresseshttps://feed.craftedsignal.io/briefs/2026-11-rdp-exposure/Thu, 05 Nov 2026 14:26:12 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-rdp-exposure/This detection identifies successful Remote Desktop Protocol (RDP) logons originating from non-private IP addresses, which may indicate a publicly-exposed RDP port.Successful RDP logons (LogonType 10) from public IP addresses can indicate that a Windows host has a publicly-exposed RDP port.

False Positives

Legitimate or intentional inbound connections from public IP addresses on the RDP port.

]]>mediumadvisoryattack.privilege-escalationattack.persistenceattack.initial-accessattack.credential-accessattack.stealthattack.t1133attack.t1078attack.t1110