TS Phish - Browser Dropping RDP Configuration (T1204.002)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•2

Detects an end-user web browser downloading an .rdp (Remote Desktop Protocol) configuration file, a primary lure for Terminal Server phishing.