Abnormal RDP connections to multiple hosts

Cortex XSIAM Analytics Alert Reference by Alert name

Product: Cortex XSIAM
Last date published: 2026-03-10
Category: Analytics Alert Reference
Index by: Alert name

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	5 Hours
Deduplication Period	1 Day
Required Data	Requires: XDR Agent
Detection Modules
Detector Tags	NDR Lateral Movement Analytics, Enhanced RDP Analytics
ATT&CK Tactic	Lateral Movement (TA0008)
ATT&CK Technique	Remote Services: Remote Desktop Protocol (T1021.001)
Severity	Informational

Description

The endpoint attempted to initiate rare RDP connections to multiple hosts.

Attacker's Goals

Attackers may attempt to move laterally across the network by using compromised accounts or machines to connect to remote hosts via the RDP protocol.

Investigative actions

Inspect the legitimacy of the user initiating the RDP connections.
Verify that this activity is not part of routine IT operations.

Variations

Abnormal RDP connections to multiple hosts

Synopsis

ATT&CK Tactic	Lateral Movement (TA0008)
ATT&CK Technique	Remote Services: Remote Desktop Protocol (T1021.001)
Severity	Low

Description

The endpoint attempted to initiate rare RDP connections to multiple hosts.

Attacker's Goals

Attackers may attempt to move laterally across the network by using compromised accounts or machines to connect to remote hosts via the RDP protocol.

Investigative actions

Inspect the legitimacy of the user initiating the RDP connections.
Verify that this activity is not part of routine IT operations.