Qradarv1.0

Inbound RDP Connection - Firewall

To allow inbound Remote Desktop Protocol (RDP) connections through the Windows Defender Firewall, enable the pre-configured Remote Desktop - User Mode (TCP-In) rule. RDP typically operates on TCP port 3389. For enhanced security, restrict the connection to specific IP addresses in the rule's Scope tab.

By ThreatBeaconX Research Team · Updated Sep 2, 2026 · 91 views

inbound-rdp-connection-firewall.aql

SELECT DATEFORMAT(devicetime,'yyyy-MM-dd hh:mm') AS "TimeStamp",LOGSOURCENAME(logsourceid) AS "LogSource Name",QIDNAME(qid) As "Event Name" ,"Logon Process" AS "Logon Process","Process Name",sourceip AS "Source IP",sourceport AS "Source Port",destinationip AS "Destination IP",destinationport AS "Destination Port",username AS "Username","Account Name" AS "Account Name", "Logon Type" AS "Logon Type" ,qideventid AS "Event ID"  FROM events
WHERE (LOGSOURCETYPENAME(deviceType) ILIKE '%Firewall_Type_Name_1%' OR LOGSOURCETYPENAME(deviceType) ILIKE '%Firewall_Type_Name_2%')
AND  NOT (sourceIP BETWEEN '10.0.0.0' AND '10.255.255.255')
AND NOT (sourceIP BETWEEN '172.16.0.0' AND '172.31.255.255')
AND NOT ( sourceIP BETWEEN '192.168.0.0' AND '192.168.255.255')
AND destinationport=3389
START PARSEDATETIME('20 days ago')