Remote Thread Creation in Mstsc.exe from Suspicious Location
Detects remote thread creation in the 'mstsc.exe' process by a process originating from a suspicious temporary or public user directory. This technique is often used by attackers to inject code into 'mstsc.exe' to hook APIs and steal credentials during RDP authentications.
Sigma
