Suspicious RDP File Execution from Outlook Cache
Detects the execution of a Remote Desktop Protocol (.rdp) file from a temporary directory associated with Microsoft Outlook. This behavior is a key indicator of the initial access phase of the "Rogue RDP" campaign, where attackers deliver malicious .rdp files via email to compromise systems.
Sigma
