Sigma rule: .RDP File Created by Outlook Process

Rule

Title

.RDP File Created by Outlook Process

Status

deprecated

Level

high

Author

Florian Roth

Date

2024-11-01

Modified

2025-07-22

File

deprecated/windows/file_event_win_office_outlook_rdp_file_creation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of files with the ".rdp" extensions in the temporary directory that Outlook uses when opening attachments.
This can be used to detect spear-phishing campaigns that use RDP files as attachments.

Log source

product

windows

category

file_event

Detection

selection_extension:
    TargetFilename|endswith: '.rdp'
selection_location:
    - TargetFilename|contains:
          - '\AppData\Local\Packages\Microsoft.Outlook_' # New Outlook
          - '\AppData\Local\Microsoft\Olk\Attachments\' # New Outlook
    - TargetFilename|contains|all:
          - '\AppData\Local\Microsoft\Windows\'
          - '\Content.Outlook\'
condition: all of selection_*

False positives (as the rule lists them)

• Whenever someone receives an RDP file as an email attachment and decides to save or open it right from the attachments

Tags

• attack.defense-evasion

Related rules

• fccfb43e-09a7-4bd2-8b37-a5a7df33386d (derived)

References

• https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/
• https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/
• https://www.linkedin.com/feed/update/urn:li:ugcPost:7257437202706493443?commentUrn=urn%3Ali%3Acomment%3A%28ugcPost%3A7257437202706493443%2C7257522819985543168%29&dashCommentUrn=urn%3Ali%3Afsd_comment%3A%287257522819985543168%2Curn%3Ali%3AugcPost%3A7257437202706493443%29

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/deprecated/windows/file_event_win_office_outlook_rdp_file_creation.yml