T1563.002 — RDP Hijacking
Tactic: Lateral Movement · Platforms: Windows
Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft…
Sub-technique of Remote Service Session Hijacking (T1563).
Sigma detection rules (1)
T1563.002 Remote Service Session Hijacking: RDP Hijacking
title: "T1563.002 Remote Service Session Hijacking: RDP Hijacking"
id: 94145b47-1433-47db-80e2-04424a99d238
description: 'Detection of Remote Service Session Hijacking for RDP. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: ExpectedRDPHosts, TimeWindow, SessionIDMapping.'
references:
- https://attack.mitre.org/techniques/T1563/002
author: Shahrukh Khan
date: 2026-01-29
license: MIT
tags:
- attack.lateral-movement
- attack.t1563.002
logsource:
category: process_creation
product: windows
service: sysmon
detection:
selection:
EventID: 1
Image|endswith: '\tscon.exe'
selection_dest:
CommandLine|contains: 'dest'
condition: selection and selection_dest
falsepositives:
- Legitimate administrative session transfers performed by help desk/support staff using tscon.exe for authorized purposes.
level: medium
Related sub-techniques
Explore