Service installed to reassign a remote desktop session with tscon

Siemphony@siemphonyhighT1563.002unverified

Detects a Windows service being installed whose image path invokes tscon or names a terminal session, which is how an operator obtains the SYSTEM rights that reassigning another user's remote desktop session requires — the service runs the command, the session moves to the adversary's terminal, and no logon event is generated for the hijacker. The System channel source was chosen over the process creation source in the same analytic because it records the setup step, is written by the Service Control Manager on every install with no audit policy to enable, and its fields (`ImagePath`, `ServiceName`) are native to that channel rather than mapped from a Sysmon vocabulary. AN1620's other half — a session reassignment with no corresponding 4624 or 4648 inside MITRE's `TimeWindow`, checked against its `SessionIDMapping` knob — is an absence correlated across two log sources, which Sigma cannot express. An adversary who already holds SYSTEM (a stolen token, a scheduled task, a remote execution tool running as the machine account) can call tscon directly and installs no service at all, so this rule sees the common path and not every path. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0588, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

Event| where ((Source =~ "Service Control Manager" and EventID == 7045) and (ImagePath contains "tscon" or ImagePath contains "rdp-tcp#"))

Splunk · SPL

Run this as a search.

index=* ((Provider_Name="Service Control Manager" AND EventID="7045") AND (ImagePath="*tscon*" OR ImagePath="*rdp-tcp#*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(winlog.provider_name) == "service control manager" AND event.code == 7045) AND (TO_LOWER(ImagePath) LIKE "*tscon*" OR TO_LOWER(ImagePath) LIKE "*rdp-tcp#*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Provider_Name" type="pcre2">(?i)^Service Control Manager$</field>    <field name="EventID" type="pcre2">(?i)^7045$</field>    <field name="ImagePath" type="pcre2">(?i)(tscon|rdp-tcp#)</field>    <description>Service installed to reassign a remote desktop session with tscon</description>    <mitre>      <id>T1563.002</id>    </mitre>  </rule></group>

At a glance

Logsource: system / windows
Level: high
Category: lateral_movement_remote_exec
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: a7803f61-39a0-4552-a23e-e4e03b1948b5

ATT&CKT1563.002

T1563.002RDP Hijacking

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonlateral movement remote exec

lateral movement remote execAI draft — unreviewed

01 · What this rule detects

This rule catches a Windows service being installed whose ImagePath references tscon (the Terminal Services Console command) or rdp-tcp# (the RDP session naming pattern) — the setup an adversary uses to wrap tscon.exe [session] in a SYSTEM-context service so they can reassign another user's disconnected or active RDP session without credentials or a logon prompt. It is the "install a helper service" precursor to the hijack, not the session-reassignment event itself.

02 · Telemetry you need

Windows System channel, EventID 7045 — the Service Control Manager logging a new service — with the Provider_Name and ImagePath fields. This channel is written on every service install with no audit policy to enable, unlike the Security-log alternative (4697), which needs Audit Other Object Access Events turned on. That's a real advantage and the rule's own description calls it out as the reason this logsource was chosen over the process-creation one.

03 · How the logic works

Two selections joined with and: - selection_service_install: Provider_Name: 'Service Control Manager' and EventID: 7045 - selection_session_takeover: ImagePath|contains: ['tscon', 'rdp-tcp#'] condition: selection_service_install and selection_session_takeover. It fires only when a freshly installed service's ImagePath string contains one of those two substrings — narrow, single-event logic, with no aggregation and no time window.

04 · Common false positives

falsepositives lists three sources, each specific: session brokers, kiosk shells and thin-client agents that legitimately install a service to reconnect a disconnected session on logoff or on schedule; remote-support and monitoring products that drop a short-lived service to reattach an unattended console for a technician, then remove it; and an admin manually wrapping tscon in a temporary service to recover a hung console — which is literally the documented way to run tscon with the privileges it needs. None of these dominates by volume, which is what keeps level: high defensible rather than contradicted by its own top entry.

05 · Detection maturity

tier_1: review.json's central finding is that this rule is precursor-only coverage of AN1620. The full analytic wants a session reassignment correlated against a missing 4624/4648 within MITRE's TimeWindow; that correlation can't be written in Sigma. This rule sees only the service-install step, so an adversary who already holds SYSTEM — a stolen token, a scheduled task, a remote-execution tool running as the machine account — can call tscon directly, install no service, and generate no EventID 7045 at all. review.json also flags scope drift: the corpus's T1563 parent rule is likewise RDP-only (matching tscon.exe /dest: and mstsc.exe /shadow:), so two rules now cover the same RDP angle from different telemetry while T1563's stated SSH-hijack scope has no coverage anywhere. This rule is UNVERIFIED — the lowest DeBMM tier. It was authored from a MITRE analytic description with no query logic supplied, has never been run against a real log, and should be validated against your own service-install baseline before its level: high is trusted.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

brief.json's mutableElements for AN1620 name three knobs: ExpectedRDPHosts (an allowlist of hosts/accounts authorized for RDP), TimeWindow (for correlating a logon with a session reassignment), and SessionIDMapping (an environment-specific session-to-account map). MITRE names these knobs — it supplies no values, and this rule implements none of them as Sigma fields. TimeWindow and SessionIDMapping belong to AN1620's other half: correlating a reassignment against an absent 4624/4648, which Sigma cannot express as a single-source query at all. Tuning this specific rule in practice means building your own allowlist of the ImagePath patterns your session-broker and remote-support tools use, and excluding them from selection_session_takeover — a knob this rule doesn't ship, that you'd add yourself.

Declared by the author

Session brokers, kiosk shells and thin-client management agents that install a service to reconnect or reassign disconnected sessions on logoff or on a schedule, which is exactly the tscon invocation this rule matches.
Remote support and monitoring products that drop a short-lived service to reattach an unattended console session for a technician, then remove it when the session ends.
An administrator recovering a hung or orphaned console session, where wrapping tscon in a temporary service is the documented way to run it with the privileges the command needs.

Noise checknot tested

No baseline event covers this rule’s log type (system / windows), so the rule was never evaluated. This is missing data, not a clean result — nothing was checked either way.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verificationnone

Never run

The lab has not evaluated this composition. A run needs a dataset of its log type — a capture of the technique it claims, or the benign baseline — and not every rule has one. Some are also held back by the evaluator’s own safety limits.

Other compositions here have been run and some carry the badge — this one has not, so nothing about it has been shown either way. Read the rule and its noise check on their own terms; silence here is the absence of evidence, not evidence of a problem.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1563.002, evaluated against their — events.

Share this rule

/u/siemphony/a7803f61-39a0-4552-a23e-e4e03b1948b5

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Service installed to reassign a remote desktop session with tscon

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it