TS Phish - Anomalous RDP Outbound Connection

Ibrahim Saud@tektrix

•updated Jun 22, 2026•6•0•5

Identifies mstsc.exe initiating outbound TCP connections to external, non-private IP addresses over port 3389, indicating a potential connection to an attacker-controlled Terminal Server.