Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

High Variance in RDP Session Duration

A machine learning job has detected unusually high variance of RDP session duration. Long RDP sessions can be used to evade detection mechanisms via session persistence, and might be used to perform tasks such as lateral movement, that might require uninterrupted access to a compromised machine.

ATT&CK coverage

Outside the enterprise matrix

T1021Remote Services 114 detections cover this technique
T1021.001Remote Desktop Protocol 50 detections cover this technique
T1210Exploitation of Remote Services 48 detections cover this technique

What the source says

References

https://docs.elastic.co/en/integrations/lmd
https://www.elastic.co/blog/detecting-lateral-movement-activity-a-new-kibana-integration
https://www.elastic.co/blog/remote-desktop-protocol-connections-elastic-security
https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html

Tagged by the source as

Data Source: Elastic DefendResources: Investigation GuideRule Type: Machine LearningRule Type: MLTactic: Lateral MovementUse Case: Lateral Movement Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.