RDP: Executing the External RDP Logins Query

Lee Kirkpatrick of Sophos X-Ops' Incident Response team shows how to create and execute the RDP Logins from External IPs query, a useful resource for understanding who's connecting to your network from outside. For more information and links to the resources mentioned in the series, please see the companion blog post: news.sophos.co...
00:00 Introduction
00:20 Looking at Logins.01.4 - RDP Logins from External IPs.sql
00:36 Creating the query
01:14 Device selection
02:20 Executing the query
03:00 Query results
03:22 Analyzing the results
04:47 Wrapup