Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Potential RDP Session Hijacking Activity

Detects potential RDP Session Hijacking activity on Windows systems

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
@juju4Created Tue Dec 27Updated Sun Dec 01224f140f-3553-4cd1-af78-13d81bf9f7ccwindows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic2 selectors
detection:
    selection_img:
        - Image|endswith: '\tscon.exe'
        - OriginalFileName: 'tscon.exe'
    selection_integrity:
        IntegrityLevel:
            - 'System'
            - 'S-1-16-16384'
    condition: all of selection_*
False Positives

Administrative activity

References
1
Resolving title…
twitter.com
MITRE ATT&CK
Rule Metadata
Rule ID
224f140f-3553-4cd1-af78-13d81bf9f7cc
Status
test
Level
medium
Type
Detection
Created
Tue Dec 27
Modified
Sun Dec 01
Author
@juju4
Path
rules/windows/process_creation/proc_creation_win_tscon_rdp_session_hijacking.yml
Raw Tags
attack.execution
View on GitHub