Multiple RDP connections from Single System

Hunt Hypothesis

Multiple RDP connections from a single system may indicate an adversary attempting to pivot within the network or exfiltrate data. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential lateral movement or unauthorized access attempts that could escalate to a full breach.

KQL Query

let endtime = 1d;
let starttime = 8d;
let threshold = 2.0;
(union isfuzzy=true
(SecurityEvent
| where TimeGenerated >= ago(endtime)
| where EventID == 4624 and LogonType == 10
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ComputerCountToday = dcount(Computer), ComputerSet = makeset(Computer), ProcessSet = makeset(ProcessName)
by Account = tolower(Account), IpAddress, AccountType, Activity, LogonTypeName),
(WindowsEvent
| where TimeGenerated >= ago(endtime)
| where EventID == 4624
| extend LogonType = tostring(EventData.LogonType)
| where  LogonType == 10
| extend ProcessName = tostring(EventData.ProcessName)
| extend Account = strcat(tostring(EventData.TargetDomainName),"\\", tostring(EventData.TargetUserName))
| extend IpAddress = tostring(EventData.IpAddress)
| extend TargetUserSid = tostring(EventData.TargetUserSid)
| extend AccountType=case(Account endswith "$" or TargetUserSid in ("S-1-5-18", "S-1-5-19", "S-1-5-20"), "Machine", isempty(TargetUserSid), "", "User")
| extend Activity="4624 - An account was successfully logged on."
| extend LogonTypeName="10 - RemoteInteractive"
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ComputerCountToday = dcount(Computer), ComputerSet = makeset(Computer), ProcessSet = makeset(ProcessName)
by Account = tolower(Account), IpAddress, AccountType, Activity, LogonTypeName)
)
| join kind=inner (
(union isfuzzy=true
(SecurityEvent
| where TimeGenerated >= ago(starttime) and TimeGenerated < ago(endtime)
| where EventID == 4624 and LogonType == 10
| summarize ComputerCountPrev7Days = dcount(Computer) by Account = tolower(Account), IpAddress
),
( WindowsEvent
| where TimeGenerated >= ago(starttime) and TimeGenerated < ago(endtime)
| where EventID == 4624  and EventData has ("10")
| extend LogonType = toint(EventData.LogonType)
| where  LogonType == 10
| extend Account = strcat(tostring(EventData.TargetDomainName),"\\", tostring(EventData.TargetUserName))
| extend IpAddress = tostring(EventData.IpAddress)
| summarize ComputerCountPrev7Days = dcount(Computer) by Account = tolower(Account), IpAddress)
)
) on Account, IpAddress
| extend Ratio = iff(isempty(ComputerCountPrev7Days), toreal(ComputerCountToday), ComputerCountToday / (ComputerCountPrev7Days * 1.0))
// Where the ratio of today to previous 7 days is more than double.
| where Ratio > threshold
| project StartTime, EndTime, Account, IpAddress, ComputerSet, ComputerCountToday, ComputerCountPrev7Days, Ratio, AccountType, Activity, LogonTypeName, ProcessSet
| extend AccountName = tostring(split(Account, @"\")[1]), AccountNTDomain = tostring(split(Account, @"\")[0])

Analytic Rule Definition

id: 78422ef2-62bf-48ca-9bab-72c69818a425
name: Multiple RDP connections from Single System
description: |
  'Identifies when an RDP connection is made to multiple systems and above the normal connection count for the previous 7 days.
  Connections from the same system with the same account within the same day.
  RDP connections are indicated by the EventID 4624 with LogonType = 10'
severity: Low
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
  - connectorId: WindowsSecurityEvents
    dataTypes:
      - SecurityEvent
  - connectorId: WindowsForwardedEvents
    dataTypes:
      - WindowsEvent
queryFrequency: 1d
queryPeriod: 8d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - LateralMovement
relevantTechniques:
  - T1021
query: |
  let endtime = 1d;
  let starttime = 8d;
  let threshold = 2.0;
  (union isfuzzy=true
  (SecurityEvent
  | where TimeGenerated >= ago(endtime)
  | where EventID == 4624 and LogonType == 10
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ComputerCountToday = dcount(Computer), ComputerSet = makeset(Computer), ProcessSet = makeset(ProcessName)
  by Account = tolower(Account), IpAddress, AccountType, Activity, LogonTypeName),
  (WindowsEvent
  | where TimeGenerated >= ago(endtime)
  | where EventID == 4624
  | extend LogonType = tostring(EventData.LogonType)
  | where  LogonType == 10
  | extend ProcessName = tostring(EventData.ProcessName)
  | extend Account = strcat(tostring(EventData.TargetDomainName),"\\", tostring(EventData.TargetUserName))
  | extend IpAddress = tostring(EventData.IpAddress)
  | extend TargetUserSid = tostring(EventData.TargetUserSid)
  | extend AccountType=case(Account endswith "$" or TargetUserSid in ("S-1-5-18", "S-1-5-19", "S-1-5-20"), "Machine", isempty(TargetUserSid), "", "User")
  | extend Activity="4624 - An account was successfully logged on."
  | extend LogonTypeName="10 - RemoteInteractive"
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ComputerCountToday = dcount(Computer), ComputerSet = makeset(Computer), ProcessSet = makeset(ProcessName)
  by Account = tolower(Account), IpAddress, AccountType, Activity, LogonTypeName)
  )
  | join kind=inner (
  (union isfuzzy=true
  (SecurityEvent
  | where TimeGenerated >= ago(starttime) and TimeGenerated < ago(endtime)
  | where EventID == 4624 and LogonType == 10
  | summarize ComputerCountPrev7Days = dcount(Computer) by Account = tolower(Account), IpAddress
  ),
  ( WindowsEvent
  | where TimeGenerated >= ago(starttime) and TimeGenerated < ago(endtime)
  | where EventID == 4624  and EventData has ("10")
  | extend LogonType = toint(EventData.LogonType)
  | where  LogonType == 10
  | extend Account = strcat(tostring(EventData.TargetDomainName),"\\", tostring(EventData.TargetUserName))
  | extend IpAddress = tostring(EventData.IpAddress)
  | summarize ComputerCountPrev7Days = dcount(Computer) by Account = tolower(Account), IpAddress)
  )
  ) on Acco

Required Data Sources

MITRE ATT&CK Context

• Tactic: LateralMovement
• Technique: T1021 — T1021

References

• Source Query

False Positive Guidance

• Scenario: Scheduled System Maintenance with RDP Access
  Description: An administrator uses RDP to perform routine maintenance on multiple servers during a scheduled maintenance window.
  Filter/Exclusion: src_ip == <admin_ip> and dst_port != 3389 or src_ip == <admin_ip> and event_time between <maintenance_start_time> and <maintenance_end_time>

• Scenario: Automated Backup Job Using RDP
  Description: A backup tool (e.g., Veeam, Acronis) connects to multiple servers via RDP to perform scheduled backups.
  Filter/Exclusion: process_name == "veeam.exe" or process_name == "acronis.exe" or src_ip == <backup_tool_ip>

• Scenario: Remote Desktop Services (RDS) Farm with Multiple Sessions
  Description: A Remote Desktop Services (RDS) environment allows multiple users to connect to different virtual machines within the same farm.
  Filter/Exclusion: dst_system == <RDS_host> or src_user == <RDS_admin_user>

• Scenario: Network Monitoring Tool with RDP Connectivity
  Description: A network monitoring tool (e.g., SolarWinds, PRTG) connects to multiple systems via RDP to gather metrics or perform health checks.
  Filter/Exclusion: process_name == "SolarWinds.exe" or process_name == "PRTG.exe" or src_ip == <monitoring_tool_ip>

• Scenario: Multi-System Deployment with RDP for Configuration
  Description: An IT team uses RDP to configure multiple systems during a deployment or patching process.
  Filter/Exclusion: event_time between <deployment_start_time> and <deployment_end_time> or src_user == <deployment_admin_user>