Windows File Events: mstsc.exe Writing to Startup Folder via tsclient Share

Flags mstsc.exe activity writing to the Windows Startup folder, indicating potential RDP session backdoor placement.

FreeUnreviewedSigmahighv1

windows-file-events-mstsc-exe-writing-to-startup-folder-via-tsclient-share-52753ea4

title: "Windows File Events: mstsc.exe Writing to Startup Folder via tsclient Share"
id: 3002505b-8f39-4f17-92d0-f59a3df45140
status: test
description: This rule identifies file creation or modification events where mstsc.exe targets files under the Windows Startup folder path. An attacker can use RDP-related client behavior and shared paths to persist a backdoor on the RDP source machine by placing it to run at startup. It relies on Windows file event telemetry that records the initiating process image and the targeted filename path containing the Startup directory.
author: Samir Bousseaden, Huntrule Team
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_tsclient_filewrite_startup.yml
date: 2019-02-21
modified: 2021-11-27
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith: \mstsc.exe
    TargetFilename|contains: \Microsoft\Windows\Start Menu\Programs\Startup\
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 52753ea4-b3a0-4365-910d-36cff487b789
    type: derived

What it detects

This rule identifies file creation or modification events where mstsc.exe targets files under the Windows Startup folder path. An attacker can use RDP-related client behavior and shared paths to persist a backdoor on the RDP source machine by placing it to run at startup. It relies on Windows file event telemetry that records the initiating process image and the targeted filename path containing the Startup directory.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.