RDP-based lateral movement via mstsc.exe across internal hosts

Ibrahim Saud@tektrix

•updated Jul 2, 2026•5•0•13

Detects anomalous internal lateral movement activity where the Remote Desktop client (mstsc.exe) establishes network connections to multiple distinct internal destinations within a short window, potentially indicating an attacker traversing the network.