RDP Session Hijack via tscon Command

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects potential RDP session hijacking attempts by looking for the string "tscon" within TCP traffic destined for port 3389 (RDP). The 'tscon' command can be used to connect to or take control of another user's RDP session.