Windows MSTSC Shadowing CommandLine Using shadow:
Flags Windows processes launching MSTSC with noconsentprompt and shadow: parameters consistent with RDP session shadowing.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2020-01-24
- Updated
- 2026-07-30
ATT&CK techniques
Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies RDP session shadowing activity on Windows by matching process command lines containing both 'noconsentprompt' and 'shadow:'. Attackers use MSTSC shadowing to observe or interact with an existing user session without establishing a typical new session channel. It relies on process creation telemetry with command-line arguments to reliably capture these distinctive parameters.
Reporting behind it
- twitter.comhttps://twitter.com/kmkz_security/status/1220694202301976576
- github.comhttps://github.com/kmkz/Pentesting/blob/47592e5e160d3b86c2024f09ef04ceb87d204995/Post-Exploitation-Cheat-Sheet
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mstsc_rdp_hijack_shadowing.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows MSTSC Shadowing CommandLine Using shadow:"
id: a1ce9442-0e37-4fcf-9884-6b1107b7b863
status: test
description: This rule identifies RDP session shadowing activity on Windows by matching process command lines containing both 'noconsentprompt' and 'shadow:'. Attackers use MSTSC shadowing to observe or interact with an existing user session without establishing a typical new session channel. It relies on process creation telemetry with command-line arguments to reliably capture these distinctive parameters.
references:
- https://twitter.com/kmkz_security/status/1220694202301976576
- https://github.com/kmkz/Pentesting/blob/47592e5e160d3b86c2024f09ef04ceb87d204995/Post-Exploitation-Cheat-Sheet
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mstsc_rdp_hijack_shadowing.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-01-24
modified: 2023-02-05
tags:
- attack.lateral-movement
- attack.t1563.002
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- noconsentprompt
- "shadow:"
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 6ba5a05f-b095-4f0a-8654-b825f4f16334
type: derived