An unexplained RDP login attempt was detected from an IP not previously associated with our infrastructure. This can indicate an account compromise attempt, which is a common precursor to a ransomware attack. Reference: Microsoft Security Response Center report on RDP exploitation (CVE-2019-0708).