RDP hijacking

Takeover of a disconnected RDP session without credentials

categoryNetwork and infrastructure attacksseverityHighdetectability (measured in our lab)Mediumlabdetected in lab

Example: tscon

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1563.002 · RDP hijacking · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1563.002 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1563.002 -TestGuids a37ac520-b911-458e-8aed-c5f1576d9f46 -TimeoutSeconds 120'

ATT&CK T1563.002 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1563.002 -Tool atomic -RunId run-2026-10-11-005 -Command 'Invoke-AtomicTest T1563.002 -TestGuids a37ac520-b911-458e-8aed-c5f1576d9f46 -TimeoutSeconds 120'

What our lab measured

detected windows · 2026-10-11 · detected in 2s

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	A C:\Windows\System32\net.exe binary was started by a Windows cmd shell
Sysmon · EID 1	Discovery activity executed
Sysmon · EID 1	RDP session hijack: service created to run tscon.exe as SYSTEM
Sysmon · EID 1	RDP session hijack: tscon.exe used to attach to another user's session
Sysmon · EID 1	Suspicious Windows cmd shell execution
Sysmon · EID 1	Windows command prompt started by an abnormal process
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
Sysmon · EID 13	Evidence of new service creation found in registry under HKLM\System\CurrentControlSet\Services\sesshijack\ImagePath binary is: cmd.exe /k tscon 1337 /dest:rdp-tcp#55
… and 8 more event type(s)

Detection that fired

✓ Wazuh 100210 (level 12) lab rule — RDP session hijack: tscon.exe used to attach to another user's session
✓ Wazuh 100211 (level 12) lab rule — RDP session hijack: service created to run tscon.exe as SYSTEM

Plus 13 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~796 incidental alerts/hour — tune against this.

2 public Sigma rule(s) also target this technique.

Classification

24 values: 14 reviewed, 2 lab-measured, 7 imported, 1 derived. What do these mean?

Exploitability

Attack vector	Network attacks
Reach (CVSS)	Local
Attack complexity	Low
Privileges required	High
User interaction	None
Attacker skill required	Medium
Resources required	Low
Likelihood / prevalence	Medium
Maturity	Established

Impact & scope

Severity	High
Impact	ConfidentialityIntegrity
Platform	Windows
Environment	On-premises
Target asset class	EndpointIdentity
Kill-chain phase (tactic)	Lateral Movement

Detection & telemetry

Detectability (measured in our lab)	Medium
Detectability (public detection content)	Medium
Noise level	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Logon Session CreationNetwork Connection CreationProcess CreationService Creation

Detection & response

Mitigated by 17

M1018 attack-mitigation
M1026 attack-mitigation
M1028 attack-mitigation
M1030 attack-mitigation
M1035 attack-mitigation
M1042 attack-mitigation
M1047 attack-mitigation
D3-APCA d3fend
D3-CSPP d3fend
D3-NTCD d3fend
D3-NTF d3fend
D3-NTSA d3fend
D3-PHDURA d3fend
D3-PMAD d3fend
D3-RTSD d3fend
D3-ST d3fend
D3-UGLPA d3fend

Detected by 5

DET0588 attack-detection-strategy
6ba5a05f-b095-4f0a-8654-b825f4f16334 sigma
f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb sigma
100210 wazuh
100211 wazuh

Tested by 1

a37ac520-b911-458e-8aed-c5f1576d9f46 atomic

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

Run	Outcome	Tool	Platform	Ran at
`run-2026-10-11-005`	detected	atomic	windows	2026-10-11

run-2026-10-11-005 — atomic_tests=1 public_sigma_rules=2 caldera=not-indexed; expected=2 incidental=21 max_level=15 dwell_s=90

Framework references

Primary source: https://attack.mitre.org/techniques/T1563/
attack: T1563.002 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Network and infrastructure attacks' table, line 201 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 2 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0003 (Phase 4 detection lab - detonation runs 2026-10-11) — Lab detonation run-2026-10-11-005 (detected): Wazuh rule(s) 100210, 100211 fired on T1563.002 within the detonation window
RDP session hijack: service created to run tscon.exe as SYSTEM