You are hunting for lateral movement via RDP. Which approach best informs a UDM-based query for detection?

• A. Filter for RDP connections on non-standard ports.
• B. Group events by user identity and time to identify repeated access patterns.
• C. Filter for events using protocol-level attributes indicating RDP connections.
• D. Correlate events based on asset role/classification.

Answer: (C)

To detect lateral movement via RDP, the strongest signal is the protocol itself. Filtering for events that carry protocol-level attributes indicating an RDP connection lets your UDM-based query pick up the actual RDP sessions across any host, port, or network path. This approach stays reliable even if attackers use standard ports or hide traffic, because it relies on the protocol signature rather than port numbers.

Grouping by user and time or correlating by asset classification can add useful context or reveal anomalous patterns, but they don’t by themselves identify the RDP activity you’re hunting. By focusing on the protocol-level indicators of RDP, you directly capture the relevant events for subsequent analysis and detection.