RDP over TLS on non-standard high ports (SpiceRAT C2 operator access)

Ankit Mehta@Secvyn

•updated Sep 17, 2026•1•0•2

Detects Remote Desktop Protocol (RDP) connections established over known suspicious high ports or to specific remote IP addresses associated with known C2 operator infrastructure (SpiceRAT). This behavior indicates potential remote interactive access by an adversary.