Windows Process Execution From RDP Share — Detection Rule
The following analytic identifies process executions originating from RDP shares on Windows endpoints. Remote Desktop Protocol (RDP) shares, typically accessed via the "tsclient" path, allow users to share files between their local machine and a remote desktop session. However, threat actors may exploit RDP shares to execute malicious processes or transfer harmful files onto a compromised system. This detection focuses on identifying any process executions that originate from RDP shares, which could indicate unauthorized access or malicious activity. Security teams should investigate any instances of such process executions, especially if they are found on systems that should not be using RDP shares or if the executed processes are unfamiliar or suspicious.