Turla STOCKSTAY mstsc.exe Spawning Suspicious Child via Phishing RDP
Detects instances where the Remote Desktop Client (mstsc.exe) is launched from common web browsers or email clients, followed shortly thereafter (within 120 seconds) by the execution of a potentially suspicious child process such as PowerShell, command prompt, WScript, or MSHTA. This pattern is indicative of a user-initiated execution flow that may be part of a phishing attack or malicious payload delivery.
Splunk (SPL)
