
title: Denied Access To Remote Desktop
author: Pushkarev Dmitry
date: 2020/06/27
description: This event is generated when an authenticated user who is not allowed
  to log on remotely attempts to connect to this computer through Remote Desktop.
  Often, this event can be generated by attackers when searching for available windows
  servers in the network.
detection:
  SELECTION_1:
    EventID: 4825
  condition: SELECTION_1
falsepositives:
- Valid user was not added to RDP group
fields:
- EventCode
- AccountName
- ClientAddress
id: 8e5c03fa-b7f0-11ea-b242-07e0576828d9
level: medium
logsource:
  product: windows
  service: security
references:
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4825
status: experimental
tags:
- attack.lateral_movement
- attack.t1076
- attack.t1021.001
ruletype: SIGMA
