| elastic |
Potential SharpRDP Behavior |
production |
2026-09-18 |
| elastic |
RDP Enabled via Registry |
production |
2026-09-18 |
| elastic |
Execution via TSClient Mountpoint |
production |
2026-09-18 |
| elastic |
Potential Remote Desktop Shadowing Activity |
production |
2026-09-18 |
| elastic |
Remote Desktop Enabled in Windows Firewall by Netsh |
production |
2026-09-18 |
| elastic |
Network-Level Authentication (NLA) Disabled |
production |
2026-09-18 |
| elastic |
Potential Remote Desktop Tunneling Detected |
production |
2026-09-18 |
| elastic |
RDP (Remote Desktop Protocol) from the Internet |
production |
2026-09-18 |
| elastic |
Unusual Windows Remote User |
production |
2026-09-18 |
| elastic |
Unusual Time or Day for an RDP Session |
production |
2026-09-18 |
| elastic |
Spike in Number of Processes in an RDP Session |
production |
2026-09-18 |
| elastic |
Spike in Number of Connections Made to a Destination IP |
production |
2026-09-18 |
| elastic |
Spike in Number of Connections Made from a Source IP |
production |
2026-09-18 |
| elastic |
High Variance in RDP Session Duration |
production |
2026-09-18 |
| elastic |
Lateral Movement via Startup Folder |
production |
2026-09-18 |
| elastic |
High Mean of Process Arguments in an RDP Session |
production |
2026-09-18 |
| elastic |
High Mean of RDP Session Duration |
production |
2026-09-18 |
| elastic |
Suspicious RDP ActiveX Client Loaded |
production |
2026-09-18 |
| splunk |
Windows Remote Services Rdp Enable |
production |
2026-05-13 |
| splunk |
Allow Inbound Traffic By Firewall Rule Registry |
production |
2026-05-13 |
| splunk |
Allow Inbound Traffic In Firewall Rule |
production |
2026-05-13 |
| splunk |
Remote Desktop Process Running On System |
experimental |
2026-05-13 |
| splunk |
Windows Default RDP File Creation By Non MSTSC Process |
production |
2026-05-13 |
| splunk |
Windows Default Rdp File Unhidden |
production |
2026-05-13 |
| splunk |
Windows MSTSC RDP Commandline |
production |
2026-05-13 |
| splunk |
Windows Process Execution From RDP Share |
production |
2026-05-13 |
| splunk |
Windows RDP Bitmap Cache File Creation |
production |
2026-05-13 |
| splunk |
Windows RDP Client Launched with Admin Session |
production |
2026-05-13 |
| splunk |
Windows RDP File Execution |
production |
2026-05-13 |
| splunk |
Windows RDP Login Session Was Established |
production |
2026-05-13 |
| splunk |
Windows RDP Server Registry Entry Created |
production |
2026-05-13 |
| splunk |
Windows Remote Service Rdpwinst Tool Execution |
production |
2026-05-13 |
| splunk |
Windows Remote Services Allow Rdp In Firewall |
production |
2026-05-13 |
| splunk |
Windows Remote Services Allow Remote Assistance |
production |
2026-05-13 |
| splunk |
Remote Desktop Network Traffic |
production |
2026-05-13 |
| sigma |
OpenCanary - RDP New Connection Attempt |
experimental |
2026-01-06 |
| sigma |
Potential Tampering With RDP Related Registry Keys Via Reg.EXE |
test |
2025-11-22 |
| sigma |
RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class |
experimental |
2025-11-15 |
| sigma |
New Remote Desktop Connection Initiated Via Mstsc.EXE |
test |
2024-06-04 |
| sigma |
Publicly Accessible RDP Service |
test |
2024-03-13 |
| sigma |
RDP Over Reverse SSH Tunnel |
test |
2024-03-12 |
| sigma |
Port Forwarding Activity Via SSH.EXE |
test |
2024-03-05 |
| sigma |
Outbound RDP Connections Over Non-Standard Tools |
test |
2024-02-09 |
| sigma |
Suspicious RDP Redirect Using TSCON |
test |
2023-05-16 |
| sigma |
RDP Login from Localhost |
test |
2022-10-09 |
| sigma |
Suspicious Plink Port Forwarding |
test |
2022-10-09 |
| sigma |
Hermetic Wiper TG Process Patterns |
test |
2022-09-09 |
| sigma |
User Added to Remote Desktop Users Group |
test |
2022-09-09 |
| sigma |
RDP over Reverse SSH Tunnel WFP |
test |
2022-09-02 |
| sigma |
RDP to HTTP or HTTPS Target Ports |
test |
2022-07-14 |
| sigma |
Denied Access To Remote Desktop |
test |
2021-11-27 |