Windows RDP Successful Logon (4624 LogonType 10) from Public IP
Alerts on successful RDP (LogonType 10) from a non-private, non-local source IP in Windows Security Event 4624.
- Product
- windows
- Service
- security
- Author
- Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity) (SigmaHQ), DRL 1.1
- Published
- 2023-01-19
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Cred AccessRecon
Resource Dev
Initial Access
Execution
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags successful Windows logon events (Event ID 4624) with LogonType 10, excluding logons where the source IP is within common private/local IPv4 and IPv6 ranges or is blank. Such activity can indicate a client connecting over RDP from an internet-facing or otherwise public address, which may correspond to publicly exposed RDP services. It relies on Windows Security log telemetry, specifically the IpAddress, EventID, and LogonType fields from the 4624 event.
Reporting behind it
- inversecos.comhttps://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html
- twitter.comhttps://twitter.com/Purp1eW0lf/status/1616144561965002752
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_successful_external_remote_rdp_login.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows RDP Successful Logon (4624 LogonType 10) from Public IP
id: 6d32234d-16fc-40fb-899b-7a71bb668dd1
related:
- id: 78d5cab4-557e-454f-9fb9-a222bd0d5edc
type: derived
- id: 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2
type: derived
status: test
description: This rule flags successful Windows logon events (Event ID 4624) with LogonType 10, excluding logons where the source IP is within common private/local IPv4 and IPv6 ranges or is blank. Such activity can indicate a client connecting over RDP from an internet-facing or otherwise public address, which may correspond to publicly exposed RDP services. It relies on Windows Security log telemetry, specifically the IpAddress, EventID, and LogonType fields from the 4624 event.
references:
- https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html
- https://twitter.com/Purp1eW0lf/status/1616144561965002752
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_successful_external_remote_rdp_login.yml
author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity), Huntrule Team
date: 2023-01-19
modified: 2024-03-11
tags:
- attack.privilege-escalation
- attack.persistence
- attack.initial-access
- attack.credential-access
- attack.stealth
- attack.t1133
- attack.t1078
- attack.t1110
logsource:
product: windows
service: security
detection:
selection:
EventID: 4624
LogonType: 10
filter_main_local_ranges:
IpAddress|cidr:
- ::1/128
- 10.0.0.0/8
- 127.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 169.254.0.0/16
- fc00::/7
- fe80::/10
filter_main_empty:
IpAddress: "-"
condition: selection and not 1 of filter_main_*
falsepositives:
- Legitimate or intentional inbound connections from public IP addresses on the RDP port.
level: medium
license: DRL-1.1