Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389
Read the full analysis on IntelFusions