Windows Security: Denied Remote Desktop Logon Attempts (Event ID 4825)

Flags Windows denied RDP connection attempts from users lacking permission to log on remotely (Event ID 4825).

FreeUnreviewedSigmamediumv1

windows-security-denied-remote-desktop-logon-attempts-event-id-4825-8e5c03fa

title: "Windows Security: Denied Remote Desktop Logon Attempts (Event ID 4825)"
id: b83ef24f-a81d-4c46-a164-0beac96cdbbf
status: test
description: This rule identifies Windows Security events where an authenticated user attempts to connect to a computer via Remote Desktop but is not permitted to log on remotely. Attackers often probe reachable systems for RDP access as part of lateral movement. Detection relies on Security log Event ID 4825 for the denied RDP connection attempt.
references:
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4825
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_not_allowed_rdp_access.yml
author: Pushkarev Dmitry, Huntrule Team
date: 2020-06-27
modified: 2021-11-27
tags:
  - attack.lateral-movement
  - attack.t1021.001
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4825
  condition: selection
falsepositives:
  - Valid user was not added to RDP group
level: medium
license: DRL-1.1
related:
  - id: 8e5c03fa-b7f0-11ea-b242-07e0576828d9
    type: derived

What it detects

This rule identifies Windows Security events where an authenticated user attempts to connect to a computer via Remote Desktop but is not permitted to log on remotely. Attackers often probe reachable systems for RDP access as part of lateral movement. Detection relies on Security log Event ID 4825 for the denied RDP connection attempt.

Known false positives

Valid user was not added to RDP group

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.