Mstsc.exe Execution With Local RDP File

SigmaHQ Detections@sigmaHQ

•updated Jun 13, 2025•2•0•34

Detects potential Remote Desktop Protocol (RDP) connections initiated via 'mstsc.exe' using a local '.rdp' file. This behavior can be indicative of an adversary establishing remote access to a system.