Terminal Services DLL Hijack via Remote Access

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects potential DLL hijacking attempts targeting Terminal Services (RDP) by looking for the string "termsrv.dll" within TCP traffic destined for port 3389 (RDP). This could indicate an attacker attempting to load a malicious DLL in place of the legitimate termsrv.dll to maintain persistence or execute arbitrary code.