Remote Interactive Logons (RDP)
Identifies remote interactive logons on a specific endpoint. The query filters UserIdentity events for LogonType=10, which typically indicates Remote Desktop or similar remote access sessions. Results are scoped by the provided aid and display up to 1,000 events, including timestamp, username, user principal, and the logon server. Useful for detecting and reviewing remote access activity during investigations or routine monitoring.
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=UserIdentity
| aid=?aid LogonType=10
|table([@timestamp,UserName,UserPrincipal,LogonServer],limit=1000)Use Cases - Review RDP usage on a host - Investigate potential unauthorized remote access - Support incident response and access audits
LogonType=10 corresponds to remote interactive logons. The aid parameter must be set to the target endpoint.
remote_interactive_logons__rdp_.yml
T1021
ByteRay
Hunting
Endpoint
Insight, Identity
2025-12-22
2025-12-22
