RDP session takeover with tscon or session shadowing

1title: RDP session takeover with tscon or session shadowing2id: f339e12c-a958-4cf7-ba2b-21dcaaff90e93status: experimental4description: |5  Detects the two command-line forms of taking over an existing Windows remote6  desktop session: tscon.exe attaching another session to a terminal, and7  mstsc.exe shadowing a live session. tscon is matched on the binary alone8  because `tscon 2` with no further arguments already connects the target9  session to the caller's own — a complete hijack that a /dest: gate would miss,10  leaving only the longer variant that appears in write-ups. The shadow arm11  matches /shadow: on its own for the same reason: where the shadowing policy12  has already been set to view or control without consent, /noConsentPrompt is13  unnecessary and `mstsc /shadow:2 /control` takes the session silently, so a14  command line carrying both switches is the higher-confidence variant to triage15  first rather than the gate. Both are the observable MITRE's AN0216 describes as16  a session takeover with no matching logon event — the hijack produces no 462417  for the hijacker, which is why the logon events in the strategy cannot carry18  this detection on their own and the process creation source is used instead.19  The event says nothing about whose session was taken, so corroborate every hit20  with 4778 (session reconnected), 4779 (session disconnected) and 4624 with21  logon type 10 on the same host around the same time; the analytic's22  ExpectedUserSessionMap knob is the per-user baseline Sigma cannot hold.23  Classic tscon abuse runs as SYSTEM through a service the adversary created, so24  a parent of services.exe on a match is corroborating rather than exculpatory.25  Scope is the Windows RDP leg of DET0079 only, which is the mechanism ATT&CK26  files as T1563.002 — AN0217's Linux screen/tmux attach and PTY reuse and27  AN0218's macOS VNC and TTY takeover are not covered here. Where this is run28  against Security 4688 rather than Sysmon Event ID 1, Audit Process Creation29  and the separate "Include command line in process creation events" policy both30  have to be enabled or the shadow arm has no CommandLine to read and only the31  tscon arm survives.32  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0079, not hand-written and not tested by its author. Any lab result is on this rule's own page.33references:34  - https://attack.mitre.org/techniques/T156335  - https://attack.mitre.org/detectionstrategies/DET007936author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)37date: 2026-08-1638tags:39  - attack.lateral-movement40  - attack.t156341  - attack.t1563.00242logsource:43  category: process_creation44  product: windows45detection:46  selection_tscon:47    Image|endswith: '\tscon.exe'48  selection_shadow:49    Image|endswith: '\mstsc.exe'50    CommandLine|contains|windash: '/shadow:'51  condition: 1 of selection*52falsepositives:53  - "Remote Desktop Connection Broker and Remote Desktop Session Host policy handling on an RDS farm, which reattach disconnected sessions programmatically on reconnect, session-limit and idle-timeout events; on any RDS deployment this is the highest-volume match by a wide margin and it carries no operator identity to triage against."54  - "Terminal server administration. Moving a disconnected session back to the console with tscon is a documented recovery step, and an administrator reattaching their own session after a network drop produces the same event as a takeover of someone else's."55  - "Help desk support tooling. Remote support and monitoring products wrap mstsc shadowing, and estates that have set the shadowing policy to no-consent for unattended servers will match on every support connection. Whether consent was possible is a policy question, not something this event answers."56  - "Session brokers, kiosk and thin-client management scripts that reassign sessions on logoff or on a schedule, which call tscon as part of normal operation."57level: medium