Suspicious Tscon Session Hijacking or Service Creation

Shadows VMB@Vemorian_Mort

•updated 12 days ago•1•0•5

Detects the use of tscon.exe to specify a destination session without a password (potential RDP session hijacking) or the creation of a Windows service related to tscon execution.