Mstsc.exe Execution From Uncommon Parent Process
Detects the execution of mstsc.exe (Microsoft Terminal Services Client) when its parent process is an uncommon application, specifically web browsers or email clients. This behavior can indicate an adversary attempting to establish an RDP connection after downloading or receiving a malicious .rdp file, potentially as part of an initial access or lateral movement attempt.
Sigma
