RDP to HTTP or HTTPS Target Ports — Detection Rule

Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443

Read the full analysis on IntelFusions