Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
51 detections
Filters
Last updated
All Time
Detection languages
27
14
4
2
2
Contributors
9
8
6
5
4
Categories
27
19
13
8
7
Platforms
43
6
5
5
2
Products / Services
13
11
9
6
6
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
IDS Classtypes
2
IDS Protocols
2
Detects the use of tscon.exe to specify a destination session without a password (potential RDP session hijacking) or the creation of a Windows service related to tscon execution.
The following analytic detects potential RDP Hijacking attempts by identifying the creation of a Windows service using sc.exe with a binary path that includes tscon.exe. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events and command-line arguments. This activity is significant as it indicates an attacker may be trying to hijack a disconnected RDP session, posing a risk of unauthorized access. If confirmed malicious, the attacker could gain control over an existing user session, leading to potential data theft or further system compromise.
This rule detects potential Remote Desktop Protocol (RDP) session hijacking or suspicious automation activity. It monitors for the execution of tscon.exe, a system utility used to control remote desktop sessions, or the usage of mstsc.exe (Remote Desktop Connection) over the standard RDP port 3389, which can be indicative of lateral movement or unauthorized access.
Detects the execution of 'tscon.exe', a Windows utility used to control Remote Desktop sessions. The rule specifically alerts when 'tscon.exe' is executed with parameters indicative of session hijacking (such as '/dest:') or when it is invoked by suspicious processes or under SYSTEM privileges, which are characteristic of RDP session hijacking techniques used for privilege escalation and lateral movement.
Detects the use of the Windows Terminal Services console tool (tscon.exe) to hijack active or disconnected Remote Desktop sessions. Attackers often execute this with SYSTEM privileges, frequently initiated via service control utilities like sc.exe, schtasks.exe, or services.exe, to gain unauthorized access to user sessions without requiring credentials.
Detects potential remote service session hijacking by monitoring for RDP session ID reuse by a different user or unauthorized SSH session reattachment (e.g., tmux/screen hijacking). It correlates logon events with process execution to identify instances where an existing session is accessed by an account other than the original owner, while excluding legitimate service/support account activity.
Detects potential remote service session hijacking by monitoring for RDP session ID reuse by a different user or unauthorized SSH session reattachment (e.g., tmux/screen hijacking). It correlates logon events with process execution to identify instances where an existing session is accessed by an account other than the original owner, while excluding legitimate service/support account activity.
Detects instances where a user performs an interactive login followed by a non-interactive login within a 1-hour window, where the source IP address and geographical location of both sessions differ. This behavior is indicative of potential session hijacking or token theft where an attacker is using stolen session artifacts from a different location.
Detects instances where a user performs an interactive login followed by a non-interactive login within a 1-hour window, where the source IP address and geographical location of both sessions differ. This behavior is indicative of potential session hijacking or token theft where an attacker is using stolen session artifacts from a different location.
Detects instances where a user performs an interactive login followed by a non-interactive login within a 1-hour window, where the source IP address and geographical location of both sessions differ. This behavior is indicative of potential session hijacking or token theft where an attacker is using stolen session artifacts from a different location.
Detects potential remote service session hijacking by monitoring for RDP session ID reuse by a different user or unauthorized SSH session reattachment (e.g., tmux/screen hijacking). It correlates logon events with process execution to identify instances where an existing session is accessed by an account other than the original owner, while excluding legitimate service/support account activity.
Detects potential remote service session hijacking by monitoring for RDP session ID reuse by a different user or unauthorized SSH session reattachment (e.g., tmux/screen hijacking). It correlates logon events with process execution to identify instances where an existing session is accessed by an account other than the original owner, while excluding legitimate service/support account activity.
Detects potential remote service session hijacking by monitoring for RDP session ID reuse by a different user or unauthorized SSH session reattachment (e.g., tmux/screen hijacking). It correlates logon events with process execution to identify instances where an existing session is accessed by an account other than the original owner, while excluding legitimate service/support account activity.
Detects instances where a user performs an interactive login followed by a non-interactive login within a 1-hour window, where the source IP address and geographical location of both sessions differ. This behavior is indicative of potential session hijacking or token theft where an attacker is using stolen session artifacts from a different location.
Detects instances where a user performs an interactive login followed by a non-interactive login within a 1-hour window, where the source IP address and geographical location of both sessions differ. This behavior is indicative of potential session hijacking or token theft where an attacker is using stolen session artifacts from a different location.
This rule detects a high volume of remote desktop session changes (logon/logoff) for a single user within a one-hour window. Event IDs 4778 and 4779 indicate a session reconnected or disconnected, respectively. A high count (>=10) could suggest suspicious activity such as session hijacking, rapid reconnections by an attacker, or automated tools interacting with remote sessions.
Detects signs of post-infection activity from the Amadey malware, specifically the unauthorized enabling of Remote Desktop Protocol (RDP) via registry modifications, the use of tscon.exe for session hijacking, unusual execution of RDP-related binaries (mstsc.exe, rdpclip.exe), and the deployment of legitimate remote access tools like AnyDesk or TeamViewer for lateral movement.
Detects RDP session hijacking using tscon command
Identifies LLM API interaction followed shortly by the execution of Impacket tools (wmiexec.py, smbexec.py), simulating attackers using AI to formulate lateral movement commands.
Identifies the use of tscon.exe without authorization to hijack or "shadow" active RDP sessions, a key lateral movement and spying technique. The rule specifically looks for tscon.exe being executed with command-line arguments '/dest:console' or '/dest:rdp-tcp', which are indicative of attempting to connect to or shadow an existing RDP session.
Detects anomalous child process execution by RustDesk, including shell spawning (cmd, powershell, etc.) or internal session-related process manipulation which may indicate unauthorized remote control, session hijacking, or exploitation of proof-of-concept permission bypass tools.
Page 1 of 3