RDP File Execution from Outlook Cache
Detects the execution of Remote Desktop Protocol (RDP) client (mstsc.exe) with an .rdp configuration file, specifically when the .rdp file is launched from common Outlook attachment or temporary internet file directories. This behavior can indicate a user being tricked into opening a malicious RDP file delivered via email, potentially leading to remote access to an attacker-controlled system or a compromised internal host.
CQL
