New RDP Connection Initiated From Domain Controller — Detection Rule

Detects an RDP connection originating from a domain controller.

Read the full analysis on IntelFusions