Suspicious Process Execution After RDP Connection

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•3

This rule detects the execution of suspicious processes ('servertool.exe' or 'encrypt.exe') on a device within 60 minutes of an inbound RDP connection being accepted. This could indicate an adversary establishing remote access and then deploying tools for further malicious activity, such as data exfiltration or encryption for ransomware.