Windows mstsc.exe launched with a local .rdp file from suspicious paths

Alerts on mstsc.exe executions that use a local .rdp file referenced from suspicious command-line paths.

FreeUnreviewedSigmahighv1

windows-mstsc-exe-launched-with-a-local-rdp-file-from-suspicious-paths-6e22722b

title: Windows mstsc.exe launched with a local .rdp file from suspicious paths
id: 7856bbd6-e873-47ea-b93f-73346aa7c0e6
status: test
description: This rule flags process creation events where mstsc.exe is executed and the command line ends with a local .rdp file reference, indicating an attempt to initiate an RDP session using a local configuration file. Attackers may use .rdp files for initial access or command-and-control since they can embed connection settings and route traffic. The detection relies on Windows process creation telemetry, matching mstsc.exe execution, a .rdp/.rdp" command-line argument, and that the command line contains one of several suspicious path patterns.
references:
  - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/
  - https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mstsc_run_local_rdp_file_susp_location.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-18
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \mstsc.exe
    - OriginalFileName: mstsc.exe
  selection_extension:
    CommandLine|endswith:
      - .rdp
      - .rdp"
  selection_paths:
    CommandLine|contains:
      - :\Users\Public\
      - :\Windows\System32\spool\drivers\color
      - ":\\Windows\\System32\\Tasks_Migrated "
      - :\Windows\Tasks\
      - :\Windows\Temp\
      - :\Windows\Tracing\
      - \AppData\Local\Temp\
      - \Downloads\
  condition: all of selection_*
falsepositives:
  - Likelihood is related to how often the paths are used in the environment
level: high
license: DRL-1.1
related:
  - id: 6e22722b-dfb1-4508-a911-49ac840b40f8
    type: derived

What it detects

This rule flags process creation events where mstsc.exe is executed and the command line ends with a local .rdp file reference, indicating an attempt to initiate an RDP session using a local configuration file. Attackers may use .rdp files for initial access or command-and-control since they can embed connection settings and route traffic. The detection relies on Windows process creation telemetry, matching mstsc.exe execution, a .rdp/.rdp" command-line argument, and that the command line contains one of several suspicious path patterns.

Known false positives

Likelihood is related to how often the paths are used in the environment

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.