.RDP File Created By Uncommon Application
Detects the creation of a file with an ".rdp" extension by applications that are not typically expected to create such files, such as web browsers, email clients, and chat applications. This can indicate an attempt to deliver a malicious RDP file to a user, potentially leading to initial access or defense evasion.
Sigma
