Detect Graphical User Interface in Microsoft Sentinel
Adversaries may use a system's graphical user interface (GUI) during an operation, commonly through a remote interactive session such as Remote Desktop Protocol (RDP), instead of a command-line interpreter. GUI-based interaction allows adversaries to search for information, execute files via mouse double-click, use the Windows Run command, or perform other actions that may be more difficult to monitor than command-line activity. This technique has been deprecated in favor of Remote Services (T1021), but detection of suspicious interactive GUI sessions remains operationally relevant. Key indicators include remote interactive logon events (Logon Type 10), unexpected explorer.exe child processes, Run dialog command usage, and interactive sessions established outside of normal business hours or from unusual source IP addresses.
MITRE ATT&CK
- Tactic
- Execution
- Canonical reference
- https://attack.mitre.org/techniques/T1061/
KQL Detection Query
// T1061 - Graphical User Interface: Detect suspicious remote interactive (RDP) sessions and GUI-based execution patterns
let SuspiciousGUIProcesses = dynamic([
"cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe",
"regsvr32.exe", "rundll32.exe", "msbuild.exe", "certutil.exe", "bitsadmin.exe",
"net.exe", "net1.exe", "whoami.exe", "ipconfig.exe", "nltest.exe",
"mimikatz.exe", "procdump.exe", "psexec.exe", "wmic.exe"
]);
let RunDialogIndicators = dynamic([
"shell:startup", "shell:common startup", "%temp%", "%appdata%",
"cmd /c", "powershell", "wscript", "cscript", "mshta"
]);
// Branch 1: Remote interactive logon events (Logon Type 10 = RemoteInteractive)
let RemoteInteractiveLogons = SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4624
| where LogonType == 10
| where AccountName !endswith "$"
| where IpAddress != "-" and IpAddress != "127.0.0.1" and IpAddress != "::1"
| extend SessionType = "RemoteInteractive_RDP"
| project TimeGenerated, Computer, AccountName, AccountDomain, LogonType,
IpAddress, IpPort, LogonProcessName, AuthenticationPackageName, SessionType;
// Branch 2: Suspicious processes spawned by explorer.exe (GUI double-click or Run dialog)
let ExplorerSpawnedSuspicious = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ (SuspiciousGUIProcesses)
| extend SessionType = "GUI_ExplorerChild"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, SessionType;
// Branch 3: Run dialog (RunDlg32) invocations with suspicious content
let RunDialogExecution = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("rundll32.exe")
| where ProcessCommandLine has_all ("shell32.dll", "RunDlg32")
| extend SessionType = "RunDialog_Launch"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, SessionType;
// Combine results
RemoteInteractiveLogons
| join kind=inner (
ExplorerSpawnedSuspicious
| extend TimeGenerated = Timestamp
| union (RunDialogExecution | extend TimeGenerated = Timestamp)
) on $left.Computer == $right.DeviceName
| where datetime_diff('minute', TimeGenerated1, TimeGenerated) between (0 .. 60)
| project TimeGenerated, Computer, AccountName, IpAddress,
SpawnedProcess = FileName, CommandLine = ProcessCommandLine,
ParentProcess = InitiatingProcessFileName, SessionType, SessionType1
| sort by TimeGenerated descDetects suspicious GUI-based adversary activity by correlating remote interactive logon events (Logon Type 10, RDP) with subsequent suspicious process execution via explorer.exe child processes or Windows Run dialog. Uses SecurityEvent for logon tracking and DeviceProcessEvents for process genealogy. Flags interactive sessions from external IPs followed by execution of reconnaissance, credential dumping, or lateral movement tools launched through the GUI rather than a command shell.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate remote administration by IT staff connecting via RDP to manage servers and workstations
- Help desk personnel using remote desktop to assist end users, spawning diagnostic tools like cmd.exe or PowerShell
- Developers using interactive RDP sessions on build servers and launching development tools via GUI
- Jump box or bastion host users who routinely access systems interactively and run standard administrative commands
Other platforms for T1061
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Remote Desktop Session with Suspicious Process Execution
Expected signal: Security Event ID 4624 (Logon Type 10) on target host showing source IP 127.0.0.1 (loopback for local test). Sysmon Event ID 1: cmd.exe created with ParentImage=explorer.exe and CommandLine containing whoami, ipconfig, net. Security Event ID 4634/4647 on logoff.
- Test 2Windows Run Dialog Command Execution
Expected signal: Sysmon Event ID 1: cmd.exe created with ParentImage=explorer.exe (Run dialog parent). Sysmon Event ID 13: Registry value set under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU recording the executed command. File creation of gui_test.txt in TEMP.
- Test 3RDP Session Discovery Commands via GUI
Expected signal: Sysmon Event ID 1 for cmd.exe spawned by explorer.exe, followed by child processes (whoami.exe, net.exe, ipconfig.exe, systeminfo.exe, tasklist.exe, netstat.exe, nltest.exe, reg.exe). Multiple process creation events within seconds from the same parent PID.
- Test 4Explorer File Double-Click Execution via GUI
Expected signal: Sysmon Event ID 11: File creation of update_service.exe in TEMP. Sysmon Event ID 1: calc.exe (renamed update_service.exe) created with ParentImage=explorer.exe. The renamed binary parent-child relationship is a key indicator of GUI double-click execution.
- Test 5Enumerate Recent RDP Connection History
Expected signal: Sysmon Event ID 1: reg.exe created with CommandLine querying Terminal Server Client registry paths. Sysmon Event ID 13: Registry value set under HKCU\Software\Microsoft\Terminal Server Client\Default for the simulated connection. Provides evidence of an adversary enumerating RDP history to identify lateral movement targets.
References (9)
- https://attack.mitre.org/techniques/T1061/
- https://attack.mitre.org/techniques/T1021/001/
- https://en.wikipedia.org/wiki/Run_command
- https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-client-faq
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1021.001/T1021.001.md
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4624
- https://github.com/JPCERTCC/LogonTracer
Unlock Pro Content
Get the full detection package for T1061 including response playbook, investigation guide, and atomic red team tests.