Rule:--Sid:4060--Summary:This event is generated when at attempt is made to connect via theRemote Desktop Protocol (RDP) as an Administrator.--Impact:Policy Violation. Remote RDP access as the Administrator user is notrecommended and may indicate malicious activity.--Detailed Information:Remote Desktop Protocol provides remote terminal service access. Connecting as the user Administrator is not recommended from outside ofthe network.  Other more secure protocols such as secure shell arepreferable for connecting inside the network and then using RDP withinthe network.An exploit for RDP attempts to connect to the internal network with theAdministrator user.--Attack Scenarios:An attacker may exploit a vulnerability in RDP using the Administratoruser.--Ease of Attack:Simple. Exploit code is available.--False Positives:If policy allows remote RDP traffic with the Administrator user, a falsepositive event will be generated.--False Negatives:Exploit traffic that does not use the Administrator user may not bedetected.--Corrective Action:Disallow the use of RDP or disallow access by AdministratorApply the appropriate vendor supplied patches.Upgrade to the latest non-affected version of the software.--Contributors:Sourcefire Vulnerability Research TeamJudy Novak <judy.novak@sourcefire.com>--Additional References:--