RDP lateral movement via mstsc.exe excluding bastion/admin hosts, off-hours or DC/VDI targets
Detects RDP-based lateral movement, including pivots into VDI, AD, and authentication infrastructure, excluding known bastion/jump hosts and flagging sessions from atypical source workstations or off-hours timing.
Microsoft Sentinel (KQL)
