RDP Logon to Domain Controller Originating from VDI Host (Gunra Ransomware)

Ankit Mehta@Secvyn

•updated Sep 30, 2026•2•0•4

Detects interactive RDP logons (LogonType 10) occurring on domain controllers or VDI authentication servers where the originating workstation name follows naming conventions associated with VDI/virtual-desktop environments. This pattern is indicative of potential lateral movement, where an adversary pivots from a compromised user VDI instance directly to sensitive infrastructure, bypassing established administrative jump box protocols.