TS Phish - RDP Group Addition (T1098)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•2•0•5

Correlates the creation of a local user with the immediate addition of that user to the "Remote Desktop Users" or "Administrators" group.