All Detections

RDP shadow session started (command)

SIGMA Detection Rules@SIGMADetectionRules
updated Sep 6, 20251017

Detects scenarios where an attacker would attempt to shadow a RDP session.

Sigma