Detection rules › Sigma
Hijack Legit RDP Session to Move Laterally
Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder
Known false positives
- Unlikely
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 11: FileCreate |
Rule body
title: Hijack Legit RDP Session to Move Laterally
id: 52753ea4-b3a0-4365-910d-36cff487b789
status: test
description: Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder
author: Samir Bousseaden
references:
- Internal Research
date: 2019-02-21
modified: 2021-11-27
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
product: windows
category: file_event
detection:
selection:
Image|endswith: '\mstsc.exe'
TargetFilename|contains: '\Microsoft\Windows\Start Menu\Programs\Startup\'
condition: selection
falsepositives:
- Unlikely
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
Image|endswith: '\mstsc.exe'
TargetFilename|contains: '\Microsoft\Windows\Start Menu\Programs\Startup\'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Image | ends_with |
| field:"Image" kind:ends_with value:"\mstsc.exe" |
TargetFilename | match |
| field:"TargetFilename" kind:match value:"\Microsoft\Windows\Start Menu\Programs\Startup\" |