TS Phish - Shadow RDP Session Execution (T1563.002)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•5

Identifies the use of tscon.exe without authorization to hijack or "shadow" active RDP sessions, a key lateral movement and spying technique. The rule specifically looks for tscon.exe being executed with command-line arguments '/dest:console' or '/dest:rdp-tcp', which are indicative of attempting to connect to or shadow an existing RDP session.