Windows NTLM Logon to TERMSRV on Non-Domain Hosts
Alerts on Windows NTLM events tied to TERMSRV targets that may be non-domain hosts, suggesting potential RDP access.
- Product
- windows
- Service
- ntlm
- Author
- James Pemberton (SigmaHQ), DRL 1.1
- Published
- 2020-05-22
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
Identifies Windows NTLM authentication events where the target appears to be a Remote Desktop service (TERMSRV) that may not belong to the expected domain context. Attackers can use RDP-style access paths to move laterally or establish remote control, making non-domain target patterns worth investigating. The rule relies on Microsoft-Windows-NTLM/Operational telemetry, matching EventID 8001 and target names starting with TERMSRV.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows NTLM Logon to TERMSRV on Non-Domain Hosts
id: ff7b0cc4-c352-4c88-beb9-64be396d5bd3
status: test
description: Identifies Windows NTLM authentication events where the target appears to be a Remote Desktop service (TERMSRV) that may not belong to the expected domain context. Attackers can use RDP-style access paths to move laterally or establish remote control, making non-domain target patterns worth investigating. The rule relies on Microsoft-Windows-NTLM/Operational telemetry, matching EventID 8001 and target names starting with TERMSRV.
references:
- n/a
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/ntlm/win_susp_ntlm_rdp.yml
author: James Pemberton, Huntrule Team
date: 2020-05-22
modified: 2021-11-27
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
product: windows
service: ntlm
definition: Requires events from Microsoft-Windows-NTLM/Operational
detection:
selection:
EventID: 8001
TargetName|startswith: TERMSRV
condition: selection
falsepositives:
- Host connections to valid domains, exclude these.
- Host connections not using host FQDN.
- Host connections to external legitimate domains.
level: medium
license: DRL-1.1
related:
- id: ce5678bb-b9aa-4fb5-be4b-e57f686256ad
type: derived