RDP session hijack via TSCON abuse command

Detects scenarios where an attacker attempts to create a service that triggers TSCON in order to preform local RDP session hijack.