Hijack Legit RDP Session to Move Laterally
Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder
Sigma rule (View on GitHub)
1title: Hijack Legit RDP Session to Move Laterally
2id: 52753ea4-b3a0-4365-910d-36cff487b789
3status: test
4description: Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder
5author: Samir Bousseaden
6references:
7 - Internal Research
8date: 2019-02-21
9modified: 2021-11-27
10tags:
11 - attack.command-and-control
12 - attack.t1219
13logsource:
14 product: windows
15 category: file_event
16detection:
17 selection:
18 Image|endswith: '\mstsc.exe'
19 TargetFilename|contains: '\Microsoft\Windows\Start Menu\Programs\Startup\'
20 condition: selection
21falsepositives:
22 - Unlikely
23level: high
References
Related rules
- Antivirus Exploitation Framework Detection
- Anydesk Temporary Artefact
- DNS Query To AzureWebsites.NET By Non-Browser Process
- GoToAssist Temporary Installation Artefact
- HackTool - Inveigh Execution Artefacts