Suspicious TSCON Start as SYSTEM
This rule detects the execution of 'tscon.exe' with SYSTEM privileges. 'tscon.exe' is a legitimate Windows utility used to connect to or disconnect from a session on a Remote Desktop Session Host server. When executed as SYSTEM, it can be used by an attacker to hijack an active RDP session without requiring credentials or user interaction, leading to privilege escalation and lateral movement. This technique is often referred to as RDP session hijacking.
Sigma
