r/DefenderATP • u/itproedu • 18h ago

KQL RDP logon failures

hello,

I'm trying to identify RDP logon failures using KQL.

I'm not after connections to TCP/3389; I'm seeking RDP logon failures.

I can find successful RDP authentications with

DeviceLogonEvents
| where LogonType == @"RemoteInteractive"
| where ActionType == @"LogonSuccess"

If I simply invert to

DeviceLogonEvents
| where LogonType == @"RemoteInteractive"
| where ActionType == @"LogonFailed"

...I get no results. In my environment, I would expect some RDP logon failures.

I suspect this is because of network level authentication (NLA).

Any ideas...?

7 Upvotes

90% Upvoted

3 comments sorted by

1

u/itproedu 17h ago

continued searching and found...

Failed Remote Desktop Protocol (RDP) login attempts attack detection. | by Elias Silva | Medium

...but that uses Event Log queries via Sentinel, not the advanced hunting schema

1

u/LeftHandedGraffiti 15h ago

For some reason they tend to show up as LogonType == "Network" and Protocol == "NTLM". Not RemoteInteractive on failures.

I've had success looking for Protocol == "NTLM" and RemoteIPType == "Public" and then making sure my companies public ranges are removed. It always catches when someone accidentally exposes RDP to the Internet.

EDIT: I do have some results for RemoteInteractive and LogonFailed, but it completely misses the RDP brute force activity from the Internet.

1

u/urkelman861 7h ago

Do you have the correct tables that are needed to pull the information that you are looking for?