Suspicious rdp files in Outlook temporary folders
Detection of spear-phishing emails containing a signed Remote Desktop Protocol (RDP) configuration file designed to connect to an actor-controlled server. In some cases, the threat actor attempted to enhance credibility by impersonating Microsoft employees and referencing other cloud providers in the phishing lures.dp files in Outlook temporary folders
Microsoft Sentinel (KQL)
