TS Phish - MSTSC Execution of Downloaded Profile (T1021.001)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•2•0•6

Correlates the recent download of an .rdp file with its execution by mstsc.exe, initiating the outbound connection to the attacker's infrastructure.