Windows mstsc.exe launched with a local .rdp file from suspicious paths
Alerts on mstsc.exe executions that use a local .rdp file referenced from suspicious command-line paths.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-18
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags process creation events where mstsc.exe is executed and the command line ends with a local .rdp file reference, indicating an attempt to initiate an RDP session using a local configuration file. Attackers may use .rdp files for initial access or command-and-control since they can embed connection settings and route traffic. The detection relies on Windows process creation telemetry, matching mstsc.exe execution, a .rdp/.rdp" command-line argument, and that the command line contains one of several suspicious path patterns.
Reporting behind it
- blackhillsinfosec.comhttps://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/
- web.archive.orghttps://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mstsc_run_local_rdp_file_susp_location.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows mstsc.exe launched with a local .rdp file from suspicious paths
id: 7856bbd6-e873-47ea-b93f-73346aa7c0e6
status: test
description: This rule flags process creation events where mstsc.exe is executed and the command line ends with a local .rdp file reference, indicating an attempt to initiate an RDP session using a local configuration file. Attackers may use .rdp files for initial access or command-and-control since they can embed connection settings and route traffic. The detection relies on Windows process creation telemetry, matching mstsc.exe execution, a .rdp/.rdp" command-line argument, and that the command line contains one of several suspicious path patterns.
references:
- https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/
- https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mstsc_run_local_rdp_file_susp_location.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-18
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \mstsc.exe
- OriginalFileName: mstsc.exe
selection_extension:
CommandLine|endswith:
- .rdp
- .rdp"
selection_paths:
CommandLine|contains:
- :\Users\Public\
- :\Windows\System32\spool\drivers\color
- ":\\Windows\\System32\\Tasks_Migrated "
- :\Windows\Tasks\
- :\Windows\Temp\
- :\Windows\Tracing\
- \AppData\Local\Temp\
- \Downloads\
condition: all of selection_*
falsepositives:
- Likelihood is related to how often the paths are used in the environment
level: high
license: DRL-1.1
related:
- id: 6e22722b-dfb1-4508-a911-49ac840b40f8
type: derived