Detect compromised RDP sessions with Microsoft Defender for Endpoint

I wrote a composite detection using the new fields.

My KQL detection detects the IsInitiatingProcessRemoteSession == true field across 7 schema tables for all your MDE devices over the last hour. It then correlates this data against the ProcessRemoteSessionIP (the IP address of the remote device from which the created process’s RDP session was initiated). In a typical ransomware attack, a threat actor might use compromised admin credentials to launch RDP attacks against workstations reachable by the compromised endpoint. This KQL query helps identify any remote IPs that exceed the threshold for conducting RDP attacks.

Linkedin Post:
https://www.linkedin.com/feed/update/urn:li:activity:7226951547111321601/

SlimKQL GitHub Repo:
https://github.com/SlimKQL/Hunting-Queries-Detection-Rules/blob/main/DefenderXDR/Detect%20human-operated%20ransomware%20attacks%20that%20use%20RDP.kql