First-Seen External RDP Logon

Shadows VMB@Vemorian_Mort

•updated yesterday•2•0•3

Detects the first-seen external Remote Desktop Protocol (RDP) logon event for a specific user and network provider (ASN) within the last 24 hours, compared against a 14-day historical baseline. This can indicate initial access via compromised credentials or RDP exploitation.