A lightweight PowerShell-based tool compiled into an EXE that monitors Windows RDP shadow sessions in real-time. It detects and alerts on four critical events (IDs 20503, 20504, 20506, 20507) related to unauthorized remote control attempts, displaying instant pop-up notifications without logging or console output.