Suspicious Mstsc.EXE Execution With Local RDP File

SigmaHQ Detections@sigmaHQ

•updated Jun 13, 2025•0•0•0

Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.