Spike in RDP Sessions

$source attempted an unusually high number of Remote Desktop Protocol (RDP) session login attempts to multiple servers. This spike can be associated with both successful and unsuccessful logins. This activity can be associated with compromised devices and lateral movement techniques.

After an attacker compromises a device on a network, they might start searching for databases, file servers, and other types of critical assets to compromise. Remote service protocols, such as RDP, can enable an attacker to laterally move across a network, from one compromised device to the next. First, the attacker sends a connection request over RDP to one or more devices. If one of these devices has Remote Desktop Services enabled, the attacker might be able to log in with stolen Windows or Active Directory credentials. Each authenticated RDP session enables the attacker to remotely access information and transfer files, helping them get closer to achieving their ultimate attack campaign objective, such as data exfiltration.