RDP Lateral Movement: Single Account to Multiple Hosts (T1021.001)

Ibrahim Saud@tektrix

•updated 12 days ago•1•0•1

This rule identifies potential RDP-based lateral movement by detecting when a single user account successfully authenticates to multiple distinct hosts using LogonType 10 (RemoteInteractive) within a 1-hour time window. A threshold of three or more distinct hosts is used to flag activity that deviates from typical single-host RDP usage.