Windows: RDP Session Startup Folder Backdoor via tsclient Share Targeting Startup Path
Flags mstsc.exe activity writing to the Windows Startup folder, indicating potential RDP session backdoor placement.
- Product
- windows
- Category
- file_event
- Author
- Samir Bousseaden (SigmaHQ), DRL 1.1
- Published
- 2019-02-21
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags file activity where tsclient-related RDP usage results in a payload being written to the RDP source machine’s Windows Startup folder. Attackers can use startup folder persistence to execute malware when the user logs in, enabling follow-on lateral movement. The detection relies on Windows file event telemetry showing ms tsc activity and a targeted filename path under the Start Menu Programs Startup directory.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: RDP Session Startup Folder Backdoor via tsclient Share Targeting Startup Path"
id: 3002505b-8f39-4f17-92d0-f59a3df45140
status: test
description: This rule flags file activity where tsclient-related RDP usage results in a payload being written to the RDP source machine’s Windows Startup folder. Attackers can use startup folder persistence to execute malware when the user logs in, enabling follow-on lateral movement. The detection relies on Windows file event telemetry showing ms tsc activity and a targeted filename path under the Start Menu Programs Startup directory.
author: Samir Bousseaden, Huntrule Team
references:
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_tsclient_filewrite_startup.yml
date: 2019-02-21
modified: 2021-11-27
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
product: windows
category: file_event
detection:
selection:
Image|endswith: \mstsc.exe
TargetFilename|contains: \Microsoft\Windows\Start Menu\Programs\Startup\
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 52753ea4-b3a0-4365-910d-36cff487b789
type: derived