RDP Client Writing to Startup Folder for Persistence
This rule detects attempts to hijack legitimate RDP sessions to establish persistence on the RDP source machine. Specifically, it looks for file creation events where the 'mstsc.exe' process (Microsoft Remote Desktop Connection client) is involved in writing a file to a user's 'Startup' folder. This technique can be used by an attacker to place a backdoor or malicious executable that will run automatically when the user logs into the RDP source machine.
Sigma
