Remote Access Tool / RDP Application Detection

Marvens Decayette@IronBranded

•updated Dec 3, 2025•26•0•296

Detect the execution of popular remote access and RDP applications. This can be used as a means to block their usage post incident. I recommend a Cool-Off time period of at least 8hours to aggregate the threat events.