Identifying File Exfiltration Via RDP Sessions
Query
DeviceFileEvents
| where FolderPath startswith "\\\\tsclient" and isnotempty(InitiatingProcessRemoteSessionIP)
| extend geo_info= tostring(geo_info_from_ip_address(InitiatingProcessRemoteSessionIP).country)
| project Timestamp,RemoteIP=InitiatingProcessRemoteSessionIP,geo_info,External_Device=InitiatingProcessRemoteSessionDeviceName,DeviceId,Connected_to=DeviceName, ActionType, FileName, FolderPath,InitiatingProcessVersionInfoFileDescription,RequestAccountName, RequestAccountDomain, IsInitiatingProcessRemoteSession, InitiatingProcessSessionId,ReportIdAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1021.001 | Remote Services: Remote Desktop Protocol |
Author: Sergio Albea (15/10/2025)
Identifying File Exfiltration via RDP Sessions
Description: The following KQL query focuses on detecting cases where files are created, modified, or otherwise accessed via RDP from another computer. Its main objective is to verify whether, during an RDP session, the connection has mapped a local disk or other redirected device — allowing us to easily identify potential cases of data exfiltration through RDP file transfer.
Explanation
This KQL query is designed to detect potential data exfiltration activities during Remote Desktop Protocol (RDP) sessions. It specifically looks for instances where files are accessed, created, or modified via RDP from another computer. The query checks if a local disk or other device has been mapped or redirected during the RDP session, which could indicate file transfers.
Here's a breakdown of what the query does:
-
Data Source: It uses the
DeviceFileEventstable, which logs file-related activities on devices. -
Filter Criteria: The query filters events where the
FolderPathstarts with\\tsclient, indicating that the file activity is occurring through a redirected device in an RDP session. It also ensures that theInitiatingProcessRemoteSessionIPis not empty, meaning the action is initiated from a remote IP. -
Geolocation Information: It extends the data by adding geolocation information (
geo_info) based on the remote IP address, helping to identify the country from which the RDP session is initiated. -
Projected Data: The query selects specific fields to display, including the timestamp of the event, the remote IP address, geolocation info, external device name, device ID, the device being connected to, action type, file name, folder path, process description, account name and domain, session ID, and report ID.
In simple terms, this query helps security analysts identify and investigate suspicious file activities during RDP sessions, which could be indicative of unauthorized data transfers.
