• Sublime Core Feed
Medium Severity

Attachment: RDP connection file

Labels

Malware/Ransomware
Credential Phishing
Archive analysis
File analysis

Description

Recursively scans files and archives to detect RDP connection files.

Coercing a target user into connecting to an attacker-owned RDP server can expose elements of their host and potentially lead to compromise.

References

@ajpc500
Created Aug 17th, 2023 • Last updated Aug 5th, 2025
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and (
  any(attachments, .file_extension =~ "rdp")
  or (
    any(attachments,
        .file_extension in~ $file_extensions_common_archives
        and any(file.explode(.), .file_extension =~ "rdp")
    )
  )
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started