Detect compromised RDP sessions with Microsoft Defender for Endpoint

MikeP751860 I don't have much to say about RDP nesting at the moment.

How are you using Sentinel analytic rules to reason "rare" RDP connections? 🙂
If so, can you do the same with Custom Detections Rules (In the XDR portal)?

For suspicious RDP session we consider additional incriminating factors, an anomaly or rarity alone typically doesn't trigger an alert. We can consider that though.