Windows Suspicious RDP Session Redirect via tscon.exe /dest:rdp-tcp#

Alerts on Windows process executions using tscon.exe-style RDP redirection to an "rdp-tcp#" destination.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2018-03-17
Updated: 2026-07-30

ATT&CK techniques

Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1021.001Remote Desktop Protocol
- T1563.002RDP Hijacking
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where the command line contains " /dest:rdp-tcp#", indicating use of tscon.exe to redirect or reattach an RDP session to an RDP transport endpoint. Attackers may use this technique to hijack or move interactive sessions while remaining inside established remote access workflows. The detection relies on Windows process creation telemetry, specifically the command line field from process-start events.

Reporting behind it

Related detections9 linkedT1021.001 — drag to rearrange

Malicious RDP Session Hijacking via tscon Command Line

Suspicious TermService ServiceDll Hijack via Registry (via registry_set)

Suspicious RDP Connection File Opened From Download or Mail Directory via Process Creation

Suspicious Firewall Rule Allowing SSH via New-NetFirewallRule During Ransomware

Malicious RDP Tunneling via ngrok (via process_creation)

Suspicious Remote Desktop Enablement via Registry By Ransomware

Suspicious Remote Desktop Enablement via netsh Firewall Rule (via process_creation)

Suspicious RDP Enablement via netsh Firewall Rule

Suspicious RDP Enablement via fDenyTSConnections Registry Modification

Windows Suspicious RDP Session Redirect via tscon.exe /dest:rdp-tcp#

Pivot detection · T1021.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-rdp-session-redirect-via-tscon-exe-dest-rdp-tcp-f72aa3e8

title: Windows Suspicious RDP Session Redirect via tscon.exe /dest:rdp-tcp#
id: 67eeba19-4f19-45b4-b280-b5ad1e691b4c
status: test
description: This rule flags process creation events where the command line contains " /dest:rdp-tcp#", indicating use of tscon.exe to redirect or reattach an RDP session to an RDP transport endpoint. Attackers may use this technique to hijack or move interactive sessions while remaining inside established remote access workflows. The detection relies on Windows process creation telemetry, specifically the command line field from process-start events.
references:
  - http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html
  - https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
  - https://www.hackingarticles.in/rdp-session-hijacking-with-tscon/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_tscon_rdp_redirect.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-03-17
modified: 2023-05-16
tags:
  - attack.lateral-movement
  - attack.t1563.002
  - attack.t1021.001
  - car.2013-07-002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: " /dest:rdp-tcp#"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL