This video illustrates how CrowdStrike Falcon® Identity Protection can detect when a user is trying to use Remote Desktop Protocol (RDP) to get into an AD Domain Controller (DC) and based on a policy, it can automatically challenge the user for MFA ensuring it is a legitimate user.
