huntrule

Windows: Detect mstsc.exe Remote Desktop connection via /v flag

Flags Windows RDP connection attempts started by mstsc.exe using the /v: target argument, excluding WSL helper scenarios.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
frack113 (SigmaHQ), DRL 1.1
Published
2022-01-07
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Lateral Movement

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creations where mstsc.exe is executed with the /v flag, indicating an attempt to initiate an RDP connection to a specified remote host. Attackers can use valid credentials to establish RDP sessions and then act as the logged-on user. The detection relies on Windows process creation telemetry, matching the mstsc.exe executable and the presence of the /v: argument in the command line, while excluding WSL-related mstsc activity.

Reporting behind it

Related detections9 linkedT1021.001 — drag to rearrange
Suspicious TermService ServiceDll Hijack via Registry (via registry_set)
Suspicious RDP Connection File Opened From Download or Mail Directory via Process Creation
Suspicious Firewall Rule Allowing SSH via New-NetFirewallRule During Ransomware
Malicious RDP Tunneling via ngrok (via process_creation)
Suspicious Remote Desktop Enablement via Registry By Ransomware
Suspicious Remote Desktop Enablement via netsh Firewall Rule (via process_creation)
Suspicious RDP Enablement via netsh Firewall Rule
Suspicious RDP Enablement via fDenyTSConnections Registry Modification
Suspicious RDP Enablement via fDenyTSConnections Registry Modification [Huntress] #2
Windows: Detect mstsc.exe Remote Desktop connection via /v flag
Pivot detection · T1021.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.