Day 4 of #100DaysofLC, and we're still looking at RDP activity. LimaCharlie makes it super easy to stream Windows Event Logs. Look for Event ID 4624 (Type 10) - those are your RDP logins. Share your LimaCharlie rules & detection strategies. Let's build strong defenses together! #ThreatHunting #DetectionEngineering #DFIR #LC