sigmamediumHunting

Denied Access To Remote Desktop

This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop. Often, this event can be generated by attackers when searching for available windows servers in the network.

MITRE ATT&CK

T1021.001

lateral-movement

Detection Query

selection:
  EventID: 4825
condition: selection

Author

Pushkarev Dmitry

Created

2020-06-27

Data Sources

windowssecurity

Platforms

windows

References

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4825

Tags

attack.lateral-movementattack.t1021.001

Raw Content

title: Denied Access To Remote Desktop
id: 8e5c03fa-b7f0-11ea-b242-07e0576828d9
status: test
description: |
  This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop.
  Often, this event can be generated by attackers when searching for available windows servers in the network.
references:
    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4825
author: Pushkarev Dmitry
date: 2020-06-27
modified: 2021-11-27
tags:
    - attack.lateral-movement
    - attack.t1021.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4825
    condition: selection
falsepositives:
    - Valid user was not added to RDP group
level: medium