Windows mstsc.exe launched with local .rdp file argument

title: Windows mstsc.exe launched with local .rdp file argument
id: e3790948-b43d-4327-b767-76e8af78173b
status: test
description: This rule flags process creation where mstsc.exe is executed with a command line ending in a local .rdp file path. Attackers can use mstsc with crafted or staged RDP connection files to initiate unauthorized remote sessions and move from initial access to command and control. It relies on Windows process creation telemetry, including the image name (or original filename) and the command line containing a .rdp argument.
references:
  - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/
  - https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mstsc_run_local_rdp_file.yml
author: Nasreddine Bencherchali (Nextron Systems), Christopher Peacock @securepeacock, Huntrule Team
date: 2023-04-18
modified: 2023-04-30
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \mstsc.exe
    - OriginalFileName: mstsc.exe
  selection_cli:
    CommandLine|endswith:
      - .rdp
      - .rdp"
  filter_optional_wsl:
    ParentImage: C:\Windows\System32\lxss\wslhost.exe
    CommandLine|contains: C:\ProgramData\Microsoft\WSL\wslg.rdp
  condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
  - Likely with legitimate usage of ".rdp" files
level: low
license: DRL-1.1
related:
  - id: 5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af
    type: derived