Hijack Legit RDP Session to Move Laterally
Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder
Sigma rule (View on GitHub)
1title: Hijack Legit RDP Session to Move Laterally
2id: 52753ea4-b3a0-4365-910d-36cff487b789
3status: test
4description: Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder
5author: Samir Bousseaden
6references:
7 - Internal Research
8date: 2019/02/21
9modified: 2021/11/27
10tags:
11 - attack.command_and_control
12 - attack.t1219
13logsource:
14 product: windows
15 category: file_event
16detection:
17 selection:
18 Image|endswith: '\mstsc.exe'
19 TargetFilename|contains: '\Microsoft\Windows\Start Menu\Programs\Startup\'
20 condition: selection
21falsepositives:
22 - Unlikely
23level: high
References
Related rules
- Potential SocGholish Second Stage C2 DNS Query
- Remote Access Tool - AnyDesk Piped Password Via CLI
- Remote Access Tool - Anydesk Execution From Suspicious Folder
- Remote Access Tool - NetSupport Execution
- Potential Amazon SSM Agent Hijacking