Windows: Detect mstsc.exe Remote Desktop connection via /v flag
Flags Windows RDP connection attempts started by mstsc.exe using the /v: target argument, excluding WSL helper scenarios.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-01-07
- Updated
- 2026-07-30
ATT&CK techniques
Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creations where mstsc.exe is executed with the /v flag, indicating an attempt to initiate an RDP connection to a specified remote host. Attackers can use valid credentials to establish RDP sessions and then act as the logged-on user. The detection relies on Windows process creation telemetry, matching the mstsc.exe executable and the presence of the /v: argument in the command line, while excluding WSL-related mstsc activity.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md#t1021001---remote-desktop-protocol
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mstsc
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mstsc_remote_connection.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect mstsc.exe Remote Desktop connection via /v flag"
id: d06539c0-e6cb-4a50-8ab3-9b8e2245558c
status: test
description: "This rule flags process creations where mstsc.exe is executed with the /v flag, indicating an attempt to initiate an RDP connection to a specified remote host. Attackers can use valid credentials to establish RDP sessions and then act as the logged-on user. The detection relies on Windows process creation telemetry, matching the mstsc.exe executable and the presence of the /v: argument in the command line, while excluding WSL-related mstsc activity."
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md#t1021001---remote-desktop-protocol
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mstsc
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mstsc_remote_connection.yml
author: frack113, Huntrule Team
date: 2022-01-07
modified: 2024-06-04
tags:
- attack.lateral-movement
- attack.t1021.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \mstsc.exe
- OriginalFileName: mstsc.exe
selection_cli:
CommandLine|contains|windash: " /v:"
filter_optional_wsl:
ParentImage: C:\Windows\System32\lxss\wslhost.exe
CommandLine|contains: C:\ProgramData\Microsoft\WSL\wslg.rdp
condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
- WSL (Windows Sub System For Linux)
level: medium
license: DRL-1.1
related:
- id: 954f0af7-62dd-418f-b3df-a84bc2c7a774
type: derived