Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

BianLian – RDP Recognizer Credential Validation Preceding Mass RDP Logons

Bianlian Lateral Movement Sentinel
MITRE ATT&CK
Remote Desktop Protocol
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (bianlian)
What This Detects
BianLian runs the RDP Recognizer tool to validate harvested/brute-forced RDP credentials before moving laterally. Flags RDP Recognizer execution followed by a burst of RemoteInteractive logons on other hosts.
Query
let scan = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName has "rdprecognizer" or ProcessCommandLine has "RDP Recognizer"
| project DeviceName, ScanTime = Timestamp, AccountName;
let rdpLogons = DeviceLogonEvents
| where Timestamp > ago(1d)
| where LogonType == "RemoteInteractive"
| project DeviceName, LogonTime = Timestamp, LogonAccount = AccountName;
scan
| join kind=inner rdpLogons on DeviceName
| where LogonTime - ScanTime between (0min .. 4h)
| summarize TargetHosts = dcount(DeviceName), Accounts = make_set(LogonAccount) by bin(ScanTime, 1h)
| where TargetHosts > 3

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.