Mstsc.EXE Execution From Uncommon Parent

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•0•0

Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.