identify_systems_receiving_remote_desktop_traffic.yml

name: Identify Systems Receiving Remote Desktop Traffic
id: baaeea15-fe8a-4090-92c2-5b60943bb608
version: 3
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: production
description: This search counts the numbers of times the system has created remote desktop traffic
search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389 by All_Traffic.dest | `drop_dm_object_name("All_Traffic")` | sort - count'
how_to_implement: To successfully implement this search you must ingest network traffic and populate the Network_Traffic data model. If a system receives a lot of remote desktop traffic, you can apply the category common_rdp_destination to it.
known_false_positives: No false positives have been identified at this time.
references: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
security_domain: network
schedule: Default Baseline