Potential Lateral Movement through RDP
Detects when a user account initiates Remote Desktop Protocol (RDP) sessions across multiple systems within a short timeframe, as identified by Microsoft Defender for Identity. This behavior may indicate potential lateral movement by an attacker or unauthorized use of administrative access
CQL · Falcon Next-Gen SIEMCopy query
#Vendor = "microsoft"
| #event.module = "defender-identity"
| Vendor.category = "AdvancedHunting-IdentityLogonEvents"
| network.protocol = "kerberos" or network.protocol = "ntlm"
| Vendor.properties.LogonType="Remote desktop"
| groupBy([user.name], function=[count(as=lateral_moves),count(field=Vendor.properties.TargetDeviceName, distinct=true, as=unique_devices),collect(fields=[Vendor.properties.DeviceName,Vendor.properties.TargetDeviceName,source.address]),min(@timestamp, as=start_time),max(@timestamp, as=end_time)])
| unique_devices > 1 //Adjust the value as per enviorment
| time_diff_min := (end_time - start_time) / 60000
| time_diff_min <= 60 //Adjust the time as per enviorment
| start_time_fmt := formatTime("%Y-%m-%d %H:%M:%S", field=start_time, timezone="UTC")
| end_time_fmt := formatTime("%Y-%m-%d %H:%M:%S", field=end_time, timezone="UTC")
| drop([start_time, end_time])
| sort([unique_devices], order=desc)This query detects potential lateral movement activity by analyzing Kerberos/NTLM remote desktop logon events from Microsoft Defender for Identity. It groups authentication events by username and flags users who logged into more than one unique device within a 60-minute window.
potential_lateral_movement_through_rdp.yml
T1021.001
Kundan Kumar
Detection
Identity
Identity
2026-05-08
2026-05-08
