The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

RDP connections originating from outside the organization

  • Published on Sep 11, 2026
  • 1 minute(s) read
Prev Next

  • Search on Category RDP

  • Open Graph Filter

  • Look for IP addresses not in IETF RFC1918 range

Note

Note that RDP logs sometimes record the host name and not the IP, even for RDP connections that originate from outside the environment. Ensure that you look for suspicious host names too (user-pc, workstation, etc.).

:
Related articles
  • RDP connections originating from outside the organization
    Endpoint Security Modules (HX) > Logon Tracker > Endpoint Security Logon Tracker Module User Guide Release 1.2.0 > Common investigative workflows > Hunting for suspicious activity
  • RDP Connections Originating from Outside the Organization
    Endpoint Security Modules (HX) > Logon Tracker > Endpoint Security Logon Tracker Module User Guide Release 1.1.9 > Common Investigative Workflows > Hunting for Suspicious Activity
  • Identify anomalous logon behavior
    Endpoint Detection and Response with Forensics (EDRF) > Detect and handle potential threats with EDRF > Configure EDRF to detect potential threats > Threat hunting with advanced detection modules > Detection using Logon Tracker