ConceptsRDP Lateral Movement Detection

RDP Lateral Movement Detection

Detecting attackers using RDP to move between hosts, by spotting anomalous interactive logons, unusual source-to-destination patterns, and unexpected use of administrative accounts over RDP, mapped to ATT&CK.

Glossary definition

7 direct links5 lessons

Concept Neighborhood

Prerequisite · arrow shows the orderRelated · bigger circles cover more lessons

Start here

Identity Telemetry

The foundation RDP Lateral Movement Detection builds on, worth understanding first.

Open concept →

Prerequisitelearn this first

Identity TelemetryStart here

The activity data generated by identity systems, sign-ins, authentication results, privilege changes, access grants, and federation events, that feeds detection, hunting, and investigation of identity-based threats.

lessons

Relatedsorted by lesson coverage

MITRE ATT&CK Framework

lessons

Pass-the-Hash Detection

lessons

Registry Run Key Detection

lessons

SMB Lateral Movement Detection

lessons

Lateral Movement

lessons

RDP

lesson

Related Lessons

5 lessons cover this concept

Build Endpoint Behavior Analytics

SOC Analyst

Correlate Identity, Remote Access, and Network Behavior

SOC Analyst

Use ATT&CK Without Overclaiming Coverage

SOC Analyst

From Hypothesis to Telemetry Contract

SOC Analyst

Engineer Rules, Tuning, and Response Contracts

SOC Analyst