[RW] - RDP Trace Removal Detection
New forensic techniques helps to have more insights about RDP-based attacks.By analyzing login sequences, screen tile caches, clipboard data, and session memory, analysts can now reconstruct full attacker activity during Remote Desktop sessions—even if the adversary tries to cover their tracks. The following KQL Query helps to identify when a ransomware attack attempts to remove the mentioned evidence via script which will be identified as executed command.
Microsoft Sentinel (KQL)
