Spike in Number of Connections Made from a Source IP

ELASTIC detection rule by Elastic · Elastic License v2

A machine learning job has detected a high count of destination IPs establishing an RDP connection with a single source IP. Once an attacker has gained access to one system, they might attempt to access more in the network in search of valuable assets, data, or further access points.

[metadata]
creation_date = "2023/10/12"
integration = ["lmd", "endpoint"]
maturity = "production"
updated_date = "2026/07/27"
min_stack_version = "9.4.0"
min_stack_comments = "Use EA (Entity Analytics) fields"

[rule]
anomaly_threshold = 70
author = ["Elastic"]
description = """
A machine learning job has detected a high count of destination IPs establishing an RDP connection with a single source
IP. Once an attacker has gained access to one system, they might attempt to access more in the network in search of
valuable assets, data, or further access points.
"""
from = "now-12h"
interval = "15m"
license = "Elastic License v2"
machine_learning_job_id = "lmd_high_rdp_distinct_count_destination_ip_for_source_ea"
name = "Spike in Number of Connections Made from a Source IP"
references = [
    "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
    "https://docs.elastic.co/en/integrations/lmd",
    "https://www.elastic.co/blog/detecting-lateral-movement-activity-a-new-kibana-integration",
    "https://www.elastic.co/blog/remote-desktop-protocol-connections-elastic-security",
]
risk_score = 21
rule_id = "3e0561b5-3fac-4461-84cc-19163b9aaa61"
setup = """## Setup

This rule requires the `host.ip` field to be populated.
For **Elastic Defend** events on versions **8.18 and above**, this field is **disabled by default**.

If you are using **Elastic Defend**, ensure host IP collection is enabled by following the configuration steps in the
[helper guide](https://www.elastic.co/docs/solutions/security/configure-elastic-defend/configure-data-volume-for-elastic-endpoint#host-fields).

The rule requires the Lateral Movement Detection integration assets to be installed, as well as file and Windows RDP process events collected by the Elastic Defend integration.

### Lateral Movement Detection Setup
The Lateral Movement Detection integration detects lateral movement activity by identifying abnormalities in file and Windows RDP events. Anomalies are detected using Elastic's Anomaly Detection feature.

#### Prerequisite Requirements:
- Fleet is required for Lateral Movement Detection.
- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
- Windows RDP process events collected by the [Elastic Defend](https://docs.elastic.co/en/integrations/endpoint) integration.
- To install Elastic Defend, refer to the [documentation](https://www.elastic.co/guide/en/security/current/install-endpoint.html).

#### The following steps should be executed to install assets associated with the Lateral Movement Detection integration:
- Go to the Kibana homepage. Under Management, click Integrations.
- In the query bar, search for Lateral Movement Detection and select the integration to see more details about it.
- Follow the instructions under the **Installation** section.
- For this rule to work, complete the instructions through **Add preconfigured anomaly detection jobs**.
"""
severity = "low"
tags = [
    "Data Source: Elastic Defend",
    "Use Case: Lateral Movement Detection",
    "Rule Type: ML",
    "Rule Type: Machine Learning",
    "Tactic: Lateral Movement",
    "Resources: Investigation Guide",
]
type = "machine_learning"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Spike in Number of Connections Made from a Source IP

Remote Desktop Protocol (RDP) is a common tool for remote management, but adversaries exploit it for lateral movement within networks. By establishing numerous connections from a single IP, attackers seek to expand their access. This detection rule leverages machine learning to identify unusual spikes in RDP connections, signaling potential unauthorized access attempts, and aids in early threat identification.

### Possible investigation steps

- Review the source IP address to determine if it is a known or trusted entity within the network.
- Analyze the list of destination IPs to identify any unusual or unauthorized systems being accessed.
- Check the timestamps of the connections to see if they align with expected activity patterns or occur during unusual hours.
- Investigate the user account associated with the RDP connections to verify if it has been compromised or is being misused.
- Correlate the spike in connections with any recent changes or incidents in the network that might explain the activity.
- Examine network logs and RDP session logs for any signs of suspicious behavior or anomalies during the connection attempts.

### False positive analysis

- Routine administrative tasks can trigger spikes in RDP connections. Regularly scheduled maintenance or software updates may cause a high number of connections from a single IP. To manage this, identify and whitelist IPs associated with known administrative activities.
- Automated scripts or tools used for network management might establish multiple RDP connections. Review and document these tools, then create exceptions for their IP addresses to prevent false alerts.
- Load balancers or proxy servers can appear as a single source IP making numerous connections. Verify the network architecture and exclude these IPs from the rule to avoid misidentification.
- Security scans or vulnerability assessments conducted by internal teams can result in a spike of connections. Coordinate with security teams to recognize these activities and exclude their IPs from triggering the rule.
- Remote work solutions or VPNs might centralize connections through a single IP, leading to false positives. Identify these IPs and adjust the rule to accommodate legitimate remote access patterns.

### Response and remediation

- Isolate the affected system immediately to prevent further lateral movement within the network. Disconnect it from the network or place it in a quarantine VLAN.
- Terminate any unauthorized RDP sessions originating from the identified source IP to halt ongoing unauthorized access attempts.
- Conduct a thorough review of the affected system for signs of compromise, including checking for unauthorized user accounts, changes in system configurations, and the presence of malware or suspicious files.
- Reset credentials for any accounts accessed via the compromised system to prevent further unauthorized access using stolen credentials.
- Implement network segmentation to limit RDP access to only necessary systems and users, reducing the attack surface for lateral movement.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine the full scope of the breach.
- Update and enhance monitoring rules to detect similar patterns of unusual RDP connection spikes, ensuring early detection of future attempts."""
[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"

[[rule.threat.technique.subtechnique]]
id = "T1021.001"
name = "Remote Desktop Protocol"
reference = "https://attack.mitre.org/techniques/T1021/001/"

[[rule.threat.technique]]
id = "T1210"
name = "Exploitation of Remote Services"
reference = "https://attack.mitre.org/techniques/T1210/"

[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

a9599a9a-6131-41d3-ae93-c3b86d6c716d

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion