Suspicious RDP Redirect Using TSCON

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•34

Detects a suspicious RDP session redirect using the 'tscon.exe' utility with the '/dest:rdp-tcp#' command-line argument. This technique can be used by adversaries to hijack an existing RDP session, potentially leading to privilege escalation or lateral movement.