Suspicious RDP Lateral Movement: mstsc Child Processes or External Login

Ankit Mehta@Secvyn

•updated Jun 30, 2026•2•0•5

This rule monitors for two high-risk behaviors related to Remote Desktop Protocol (RDP) usage: 1) The mstsc.exe process spawning suspicious administrative or scripting tools, and 2) Successful RDP logins originating from non-RFC1918 (external) IP addresses or occurring during non-standard business hours (08:00 PM to 06:00 AM). These patterns are indicative of potential initial access, lateral movement, or post-exploitation activities via RDP.