Suspicious Process Execution After RDP Connection

nomit vyas@xoxo

•updated Jun 24, 2026•1•0•6

This rule detects the execution of suspicious processes ('servertool.exe' or 'encrypt.exe') within 60 minutes of an inbound RDP connection being accepted on a device. This could indicate an adversary establishing remote access and then deploying tools for further compromise, such as data exfiltration or encryption for ransomware.