Rdp Flowchart link

Addes a link related a flowchart that shows clearly how to identify and recognise rdp related events.
ThreatHuntingProject · Nov 17, 2021 · 5f2d0fb · 5f2d0fb
1 parent 13549af
commit 5f2d0fb
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/hunts/rdp_external_access.md b/hunts/rdp_external_access.md
@@ -20,3 +20,4 @@ Stack counting can be effective if the analyst can easily identify anomalies in
 
 * [Hunting Through RDP Data - Josh Liburdi (BroCon 2015)](https://www.youtube.com/watch?v=mOV_9YMgYZw)
 * [CAR-2016-04-005: Remote Desktop Login](https://car.mitre.org/wiki/CAR-2016-04-005), MITRE Cyber Analytic Repository
+* [RDP Flowchart - 13CUbed](https://www.13cubed.com/downloads/rdp_flowchart.pdf)