RDP Hijacking

// Part 1: Direct tscon.exe execution — primary indicator of RDP session hijacking
let SuspiciousParents = dynamic(["cmd.exe", "powershell.exe", "powershell_ise.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe"]);
let PrivilegedParents = dynamic(["services.exe", "svchost.exe", "psexec.exe", "psexesvc.exe"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "tscon.exe"
| extend IsSystemContext = (AccountName =~ "SYSTEM" or AccountDomain =~ "NT AUTHORITY")
| extend SuspiciousParent = InitiatingProcessFileName in~ (SuspiciousParents)
| extend PrivilegedParent = InitiatingProcessFileName in~ (PrivilegedParents)
| extend HasSessionArg = ProcessCommandLine matches regex @"tscon\.exe\s+\d+"
| extend HasDestArg = ProcessCommandLine has "/dest:"
| project Timestamp, DeviceName, AccountName, AccountDomain, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         IsSystemContext, SuspiciousParent, PrivilegedParent, HasSessionArg, HasDestArg
| sort by Timestamp desc
| union (
// Part 2: Service creation to run tscon.exe as SYSTEM (privilege escalation vector)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "sc.exe"
| where ProcessCommandLine has "tscon"
| extend TacticDetail = "Service-based tscon execution — SYSTEM privilege escalation for session hijack"
| project Timestamp, DeviceName, AccountName, AccountDomain, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, TacticDetail
)
| union (
// Part 3: Session enumeration immediately before potential hijack (recon phase)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("qwinsta.exe", "query.exe")
| where ProcessCommandLine has_any ("session", "user", "/server:")
| extend TacticDetail = "RDP session enumeration — likely precursor to session hijack"
| project Timestamp, DeviceName, AccountName, AccountDomain, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, TacticDetail
)
| sort by Timestamp desc

| union
[
  search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    Image="*\\tscon.exe"
  | eval Detection="tscon_direct_execution"
  | eval IsSystemContext=if(match(User, "(?i)(system|nt authority)"), 1, 0)
  | eval HasSessionArg=if(match(CommandLine, "tscon\.exe\s+\d+"), 1, 0)
  | eval HasDestArg=if(match(CommandLine, "/dest:"), 1, 0)
  | eval SuspiciousParent=if(match(ParentImage, "(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe)"), 1, 0)
  | table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine,
          Detection, IsSystemContext, HasSessionArg, HasDestArg, SuspiciousParent
]
[
  search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    Image="*\\sc.exe" CommandLine="*tscon*"
  | eval Detection="service_creation_tscon"
  | eval TacticDetail="Service-based tscon execution for SYSTEM privilege"
  | table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, Detection, TacticDetail
]
[
  search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    (Image="*\\qwinsta.exe" OR (Image="*\\query.exe" AND (CommandLine="*session*" OR CommandLine="*user*")))
  | eval Detection="rdp_session_enumeration"
  | table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, Detection
]
[
  search index=wineventlog sourcetype="WinEventLog:Security"
    (EventCode=4778 OR EventCode=4779)
  | eval Detection=case(
      EventCode=4778, "rdp_session_reconnect",
      EventCode=4779, "rdp_session_disconnect",
      true(), "unknown"
    )
  | eval AccountName=mvindex(Account_Name, 0)
  | eval ClientName=mvindex(Client_Name, 0)
  | eval SessionName=mvindex(Session_Name, 0)
  | table _time, host, AccountName, ClientName, SessionName, EventCode, Detection
]
| sort - _time

process where event.type == "start" and
  process.name : "tscon.exe" and
  (
    process.parent.name : ("cmd.exe","powershell.exe","powershell_ise.exe","pwsh.exe",
                            "wscript.exe","cscript.exe","mshta.exe","services.exe","svchost.exe") or
    process.args : ("/dest:console","/v","/password:")
  )

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') as EventTime,
  logsourcename(logsourceid) as LogSource, username as User,
  "Image" as ProcessImage, "CommandLine" as CommandLine, "ParentImage" as ParentProcess,
  CASE WHEN "ParentImage" ILIKE '%services.exe%' OR "ParentImage" ILIKE '%svchost.exe%' THEN 10
       WHEN "CommandLine" ILIKE '%/dest:console%' THEN 9
       WHEN "ParentImage" ILIKE '%powershell%' THEN 8
       ELSE 6 END as RiskScore
FROM events
WHERE eventid IN (1, 4688)
  AND "Image" ILIKE '%tscon.exe%'
  AND (
    LOWER(coalesce("ParentImage","")) LIKE ANY ('%cmd.exe%','%powershell%','%wscript%','%cscript%',
                                                 '%mshta%','%services.exe%','%svchost%','%psexec%')
    OR "CommandLine" ILIKE '%/dest:console%'
    OR "CommandLine" ILIKE '%/password:%'
  )
ORDER BY RiskScore DESC, EventTime DESC

_sourceCategory=windows/sysmon OR _sourceCategory=windows/security
| json auto
| where EventID in ("1","4688")
| where toLower(coalesce(Image, NewProcessName, "")) matches ".*tscon\.exe$"
| eval ParentLower = toLower(coalesce(ParentImage, ParentProcessName, ""))
| eval CmdLower = toLower(coalesce(CommandLine,""))
| eval is_suspicious = if(
    ParentLower matches ".*(cmd|powershell|wscript|cscript|mshta|services|svchost|psexec).*" OR
    CmdLower matches ".*/dest:console.*" OR CmdLower matches ".*/password:.*",
    1, 0)
| where is_suspicious == 1
| eval risk = if(ParentLower matches ".*(services|svchost).*", "critical",
    if(ParentLower matches ".*(powershell|wscript|psexec).*", "high", "medium"))
| table _time, Computer, User, Image, CommandLine, ParentImage, risk
| sort by _time desc

rule rdp_session_hijacking {
  meta:
    author = "Detection Engineering"
    description = "Detects RDP session hijacking via tscon.exe (T1563.002)"
    severity = "HIGH"
    tactic = "TA0008"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.target.process.file.full_path, `(?i)tscon\.exe`) nocase
    (
      re.regex($e.principal.process.file.full_path, `(?i)(cmd\.exe|powershell|wscript|cscript|mshta|services\.exe|svchost)`) nocase or
      re.regex($e.target.process.command_line, `(?i)/dest:console|/password:`) nocase
    )

  condition:
    $e
}

#event_simpleName = "ProcessRollup2"
| ImageFileName = /tscon\.exe$/i
| (ParentBaseFileName = /(cmd|powershell|pwsh|wscript|cscript|mshta|services|svchost|psexec)/i
   OR CommandLine = /(\/dest:console|\/password:)/i)
| eval risk = case {
    ParentBaseFileName = /(services|svchost)/i : "critical";
    CommandLine = /\/dest:console/i : "high";
    ParentBaseFileName = /(powershell|psexec)/i : "high";
    * : "medium"
  }
| table timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, risk
| sort by timestamp desc