Suspicious RDP File Execution From Email Attachment

Aaron Mog@AaronMogS2S

•updated May 2, 2025•1•5•39

Detects the execution of mstsc.exe pointing to RDP files in temporary directories typical for email attachments, potentially indicating malicious activity as seen in the UNC5837 "Rogue RDP" campaign.