New Remote Desktop Connection Initiated Via Mstsc.EXE (954f0af7-62dd-418f-b3df-a84bc2c7a774)
Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.