Detection rules › By eventMicrosoft-Windows-NTLM event 80011 detection rule reference this event. View event page.Sigma (1)Potential Remote Desktop Connection to Non-Domain Host severity medium T1219.002