Potential MSTSC Shadowing Activity

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•23

Detects the use of MSTSC (Microsoft Terminal Services Client) with specific command-line arguments ('noconsentprompt' and 'shadow:') which indicates an attempt to perform RDP session shadowing without user consent. This technique can be used for RDP session hijacking.