Suspicious RDP Connection from Scripting/PowerShell Process

nomit vyas@xoxo

•updated Jun 24, 2026•2•0•6

This rule detects network connections initiated by scripting engines (wscript.exe, cscript.exe) or PowerShell (powershell.exe) to common Remote Desktop Protocol (RDP) ports (3389, 3390, 3391). This activity can be indicative of an adversary attempting to establish or pivot RDP sessions using unexpected processes, potentially for lateral movement or persistence.