Suspicious RDP Cache File Access

Brandon Rodriguez@BMRodriguez

•updated Apr 30, 2026•14•1•535

Detects unusual processes accessing the RDP Terminal Server Client Cache folder, indicating potential reconnaissance or staging for exfiltration. Attackers target this cache to exfiltrate and reconstruct image fragments of past remote sessions.