Windows: Uncommon Process Creates .rdp Remote Desktop File
Alerts on creation of .rdp files by processes that are not typically associated with producing them on Windows.
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-18
- Updated
- 2026-07-31
What it detects
This rule identifies file creation events where the target filename ends with .rdp and the creating process image matches a set of applications that are uncommon sources for generating Remote Desktop Protocol files. Attackers can use rogue .rdp files as an initial access or stealth mechanism, so alerting on these unexpected creators helps surface suspicious file artifacts. The rule relies on Windows file event telemetry that records the created filename and the process image responsible for the creation.
Reporting behind it
- blackhillsinfosec.comhttps://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/
- web.archive.orghttps://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_rdp_file_susp_creation.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Uncommon Process Creates .rdp Remote Desktop File"
id: bc26bee9-c7d3-4dd7-b001-e50a7f1a707c
related:
- id: f748c45a-f8d3-4e6f-b617-fe176f695b8f
type: derived
- id: fccfb43e-09a7-4bd2-8b37-a5a7df33386d
type: derived
status: test
description: This rule identifies file creation events where the target filename ends with .rdp and the creating process image matches a set of applications that are uncommon sources for generating Remote Desktop Protocol files. Attackers can use rogue .rdp files as an initial access or stealth mechanism, so alerting on these unexpected creators helps surface suspicious file artifacts. The rule relies on Windows file event telemetry that records the created filename and the process image responsible for the creation.
references:
- https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/
- https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_rdp_file_susp_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-18
modified: 2024-11-01
tags:
- attack.stealth
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|endswith: .rdp
Image|endswith:
- \brave.exe
- \CCleaner Browser\Application\CCleanerBrowser.exe
- \chromium.exe
- \firefox.exe
- \Google\Chrome\Application\chrome.exe
- \iexplore.exe
- \microsoftedge.exe
- \msedge.exe
- \Opera.exe
- \Vivaldi.exe
- \Whale.exe
- \olk.exe
- \Outlook.exe
- \RuntimeBroker.exe
- \Thunderbird.exe
- \Discord.exe
- \Keybase.exe
- \msteams.exe
- \Slack.exe
- \teams.exe
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1