Suspicious Denied Access To Remote Desktop (via security)

title: Suspicious Denied Access To Remote Desktop (via security)
id: d26f85dd-ce1b-5eb3-9ca0-5b52273b0570
status: stable
description: This rule detects this event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop. Often, this event can be generated by adversaries when searching for available windows servers in the network.
references:
    - https://attack.mitre.org/techniques/T1021/001/
    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4825
author: Huntrule Team
date: 2026-02-02
tags:
    - attack.lateral-movement
    - attack.t1021.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4825
    condition: selection
falsepositives:
    - Unknown
level: medium