Windows Suspicious RDP Session Redirect via tscon.exe /dest:rdp-tcp#

title: Windows Suspicious RDP Session Redirect via tscon.exe /dest:rdp-tcp#
id: 67eeba19-4f19-45b4-b280-b5ad1e691b4c
status: test
description: This rule flags process creation events where the command line contains " /dest:rdp-tcp#", indicating use of tscon.exe to redirect or reattach an RDP session to an RDP transport endpoint. Attackers may use this technique to hijack or move interactive sessions while remaining inside established remote access workflows. The detection relies on Windows process creation telemetry, specifically the command line field from process-start events.
references:
  - http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html
  - https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
  - https://www.hackingarticles.in/rdp-session-hijacking-with-tscon/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_tscon_rdp_redirect.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-03-17
modified: 2023-05-16
tags:
  - attack.lateral-movement
  - attack.t1563.002
  - attack.t1021.001
  - car.2013-07-002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: " /dest:rdp-tcp#"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb
    type: derived