Internet-Exposed RDP - Inbound Accepts from Public IPs
Identifies hosts that accepted inbound RDP connections (port 3389) from public, non RFC1918 source addresses, indicating RDP exposure to the internet or brute force activity against it.
#event_simpleName=NetworkReceiveAcceptIP4 event_platform=Win
| LocalPort=3389
// Drop private, loopback, link-local and CGNAT source ranges
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16", "100.64.0.0/10"])
| groupBy([ComputerName, aip], function=[count(as=TotalAccepts), count(RemoteAddressIP4, distinct=true, as=UniqueRemoteIPs), collect([RemoteAddressIP4], limit=20), max(@timestamp, as=LastSeen)])
| formatTime("%Y-%m-%d %H:%M:%S", field=LastSeen, as=LastSeen)
| sort(UniqueRemoteIPs, order=desc, limit=200)What it looks for: NetworkReceiveAcceptIP4 events where a Windows host completed an inbound TCP connection on port 3389 and the source address is not in a private, loopback, link-local or carrier-grade NAT range. Results are aggregated per host: total accepted connections, number of unique public source IPs, a sample of those IPs and the last time it happened. A single host with many unique public sources is either exposed RDP under brute force or a port-forwarding rule someone forgot about.
Telemetry needed: Falcon sensor network telemetry on Windows (NetworkReceiveAcceptIP4).
False positives / tuning: jump hosts and bastion servers that legitimately serve RDP from the outside will appear; move them to an allowlist on ComputerName. Environments that route internal traffic through non RFC1918 addressing (some VPN or SD-WAN setups) need those ranges added to the cidr exclusion list. To hunt session hijacking instead of exposure, pivot from a hit into UserLogon events on the same host.
