Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1078-valid-accounts

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects successful Remote Desktop logons to Windows from non-private client IP addresses. A signal is raised when the source IP is newly observed for the target user account after the learning period completes.

Strategy

This rule monitors Windows Security events where @evt.id is 4624 and @Event.EventData.Data.LogonType is 10 (remote interactive logon). Events are limited to client addresses that are not classified as private internal networks. The detection tracks @network.client.ip for each @Event.EventData.Data.TargetUserName. After the learning period, a signal is raised for any RDP logon from a source IP the account has not previously used.

Triage and response

• Verify on {{host}} whether {{@Event.EventData.Data.TargetUserName}} is expected to use Remote Desktop and whether {{@network.client.ip}} matches a known ISP, VPN exit, or partner network for that user.
• Review recent sign-in history and account lifecycle changes (new hire, role change, break-glass use) that would explain a first-time source IP for that account.
• Examine adjacent Security events on the same host around the logon time for failed attempts, privilege changes, or service installations that would support follow-on activity.