Possible RDP Session Hijacking Behavior (via process_creation)

title: Possible RDP Session Hijacking Behavior (via process_creation)
id: 86c36196-b30d-5c4b-ac76-75d03aaaf322
status: stable
description: This rule detects potential RDP Session Hijacking behavior on Windows systems
references:
    - https://twitter.com/Moti_B/status/909449115477659651
author: 'Huntrule Team'
date: 2026-06-05
tags:
    - attack.execution
    - attack.lateral-movement
    - attack.t1563.002
    - attack.t1021.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\tscon.exe'
        - OriginalFileName: 'tscon.exe'
    selection_integrity:
        IntegrityLevel:
            - 'System'
            - 'S-1-16-16384'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium