RDP logons (4624 type 10) from BlackSuit actor hostnames DESKTOP-0MEMSEA/BIFFSC7

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•2

Detects Remote Desktop Protocol (RDP) logons, reconnections, and session disconnections involving specific actor hostnames or client names over a 7-day aggregation window, summarizing by IP address and source name.