Suspicious Mstsc.EXE Execution With Local RDP File From Unusual Path
This rule detects the execution of 'mstsc.exe' (Microsoft Terminal Services Client) when it attempts to open a local RDP file located in suspicious directories. Adversaries may place RDP files in these locations to establish remote desktop connections, potentially for persistence, lateral movement, or command and control. The rule specifically looks for 'mstsc.exe' being executed with a command line argument ending in '.rdp' or '.rdp"' and containing paths commonly associated with temporary files, public user folders, or system directories that are not typical for legitimate RDP file storage.
Sigma
