LoFP
/
T1598.002
T1598.002
Title
Tags
false positives may be present based on administrators using rdp files for legitimate purposes. filter as needed.
t1021.001
T1598.002
endpoint
splunk
LoFP
/
T1598.002