---
title: Windows new external RDP logon from public IP
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Windows new external RDP logon from
  public IP
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Windows new external RDP logon from public IP

{% alert level="danger" %}
This rule is part of a beta feature. To learn more, [contact Support](https://docs.datadoghq.com/help/).
{% /alert %}
Classification:attackTactic:[TA0001-initial-access](https://attack.mitre.org/tactics/TA0001)Technique:[T1078-valid-accounts](https://attack.mitre.org/techniques/T1078) 
## Goal{% #goal %}

Detects successful Remote Desktop logons to Windows from non-private client IP addresses. A signal is raised when the source IP is newly observed for the target user account after the learning period completes.

## Strategy{% #strategy %}

This rule monitors Windows Security events where `@evt.id` is `4624` and `@Event.EventData.Data.LogonType` is `10` (remote interactive logon). Events are limited to client addresses that are not classified as private internal networks. The detection tracks `@network.client.ip` for each `@Event.EventData.Data.TargetUserName`. After the learning period, a signal is raised for any RDP logon from a source IP the account has not previously used.

## Triage and response{% #triage-and-response %}

- Verify on `{{host}}` whether `{{@Event.EventData.Data.TargetUserName}}` is expected to use Remote Desktop and whether `{{@network.client.ip}}` matches a known ISP, VPN exit, or partner network for that user.
- Review recent sign-in history and account lifecycle changes (new hire, role change, break-glass use) that would explain a first-time source IP for that account.
- Examine adjacent Security events on the same host around the logon time for failed attempts, privilege changes, or service installations that would support follow-on activity.