Suspicious RDP File Staging

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

Detects files staged in C:\Users\Public\Music via RDP (mstsc.exe), a known Grixba ransomware scanner behavior.