Inbound Remote Desktop Traffic from an Unusual Location

Microsoft Remote Desktop is a common target for attackers because it provides access to Windows devices. Attackers can find weak passwords through low-cost techniques such as brute force attacks or by exploiting RDP server vulnerabilities to bypass authentication. The impact to a business can be low if the RDP connection attempt fails or if the attacker connects to a device with limited privileges. However, these activities should be examined before they facilitate critical and costly attacks.

The system might change the risk score for this detection.