Description
- This signature trips when the sensor sees a remote IP requesting an RDP login to an EDC host. It is recommended to restrict or eliminate RDP access from the internet.
Vector
- RDP Port 3389
User-Agent
- N/A
Known False Positive Indicators
- N/A (Signature is set to Alert Only)
Affected Host
- EDC
Classification
- Trojan
Sentinel Signature
-
TROJAN MS Remote Desktop edc User Login Request
DNS Calls
- N/A
Comments
0 comments
Please sign in to leave a comment.