- This signature trips when the Sentinel sees a remote IP requesting an RDP login to an EDC host. It is recommended to restrict or eliminate RDP access from the internet.
- RDP Port 3389
Known False Positive Indicators
- N/A (Signature is set to Alert Only)
TROJAN MS Remote Desktop edc User Login Request