MITRE ATT&CK Tactic
Lateral Movement
2 queries tagged with this tactic.
View on MITRE ATT&CK →
-
Analytics Rules
Detect Remote Shell Command Arrival Over Wire
Shell command that arrived over the network — outbound-then-inbound-executed script pattern uncommon in legitimate remote code execution.
-
Hunting / User Activity
RDP Logins Per Day Per User
RDP logins per user per day (30d) rendered as a timechart. Use for baselining "normal" login volume before hunting for anomalies.