Windows Suspicious RDP Session Redirect via tscon.exe /dest:rdp-tcp#
Alerts on Windows process executions using tscon.exe-style RDP redirection to an "rdp-tcp#" destination.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2018-03-17
- Updated
- 2026-07-30
ATT&CK techniques
Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where the command line contains " /dest:rdp-tcp#", indicating use of tscon.exe to redirect or reattach an RDP session to an RDP transport endpoint. Attackers may use this technique to hijack or move interactive sessions while remaining inside established remote access workflows. The detection relies on Windows process creation telemetry, specifically the command line field from process-start events.
Reporting behind it
- korznikov.comhttp://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html
- medium.comhttps://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
- hackingarticles.inhttps://www.hackingarticles.in/rdp-session-hijacking-with-tscon/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_tscon_rdp_redirect.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Suspicious RDP Session Redirect via tscon.exe /dest:rdp-tcp#
id: 67eeba19-4f19-45b4-b280-b5ad1e691b4c
status: test
description: This rule flags process creation events where the command line contains " /dest:rdp-tcp#", indicating use of tscon.exe to redirect or reattach an RDP session to an RDP transport endpoint. Attackers may use this technique to hijack or move interactive sessions while remaining inside established remote access workflows. The detection relies on Windows process creation telemetry, specifically the command line field from process-start events.
references:
- http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html
- https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
- https://www.hackingarticles.in/rdp-session-hijacking-with-tscon/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_tscon_rdp_redirect.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-03-17
modified: 2023-05-16
tags:
- attack.lateral-movement
- attack.t1563.002
- attack.t1021.001
- car.2013-07-002
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains: " /dest:rdp-tcp#"
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb
type: derived