Device Detectanomalousrdpconnections

KQL detection rule by reprise99 · MIT

Visualizes potentially anomalous RDP connections from your devices.

//Visualizes potentially anomalous RDP connections from your devices.

//Data connector required for this query - M365 Defender - Device* tables

//Starttime and timeframe = how many days of data to look at to build your data set and in what grouping, i.e 30 days of data over 2 hour periods.
//Threshold = the amount of total RDP connections required to be included in anomaly calculations. Reduces noise from low level anomalies, e.g going from 1 connection to 2.
//Sensitivity = adjust to make the query more or less sensitive, the higher the value, the greater the anomaly required to be detected.
let starttime = 30d;
let timeframe = 2h;
let sensitivity = 3;
let threshold = 5;
let outlierdevices=
    DeviceNetworkEvents
    | where TimeGenerated > ago(starttime)
    | where LocalIPType == "Private"
    | where RemotePort == "3389"
    // Exclude Defender for Identity which uses RDP to map your network
    | where InitiatingProcessFileName <> "Microsoft.Tri.Sensor.exe"
    | project TimeGenerated, DeviceName
    | order by TimeGenerated
    | summarize RDPEvents=count()by DeviceName, bin(TimeGenerated, timeframe)
    | where RDPEvents > threshold
    | summarize EventCount=make_list(RDPEvents), TimeGenerated=make_list(TimeGenerated) by DeviceName
    | extend outliers=series_decompose_anomalies(EventCount, sensitivity)
    | mv-expand TimeGenerated, EventCount, outliers
    | where outliers == 1
//Optionally visualize the anomalies, remove everything below this line to just retrieve the data
    | distinct DeviceName;
DeviceNetworkEvents
| where TimeGenerated > ago(starttime)
| where DeviceName in (outlierdevices)
| where LocalIPType == "Private"
| where RemotePort == "3389"
| where InitiatingProcessFileName <> "Microsoft.Tri.Sensor.exe"
| summarize RDPCount=count() by DeviceName, bin(TimeGenerated, timeframe)
| render timechart

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

c018ae6b-3136-4d31-a9c6-4da0201190fa

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion