RDP Bitmap Cache File Deletion

Brandon Rodriguez@BMRodriguez

•updated Apr 30, 2026•4•0•397

Detects the deletion of RDP Bitmap Cache files (.bin, .bmc) within the Terminal Server Client Cache folder. Adversaries perform this as an anti-forensics technique to cover their tracks after harvesting session data for image fragment reconstruction.