PowerShell Compressing RDP Cache

Brandon Rodriguez@BMRodriguez

•updated Apr 30, 2026•5•0•311

Detects PowerShell command-line executions attempting to compress data originating from the Windows RDP Bitmap Cache directory. Attackers perform this action to stealthily exfiltrate captured RDP session image fragments for offline reconstruction.