← Blog

We hijacked an RDP session in the lab. Here's exactly what fired.

Detection win · 2026-10-14

Most detection content tells you a technique could be caught. We detonate the technique in an isolated lab and tell you what a SIEM actually did. Here is one run, start to finish.

The technique is RDP session hijacking (rdp-hijacking, ATT&CK T1563.002): an attacker who is already SYSTEM on a host attaches to someone else's disconnected RDP session — no password, no theft, just tscon.exe. It is quiet because every step is a legitimate Windows tool.

What we ran

Three commands, straight from the Atomic Red Team test, in the isolated victim:

query user
sc.exe create sesshijack binpath= "cmd.exe /k tscon 1337 /dest:rdp-tcp#55"
net start sesshijack

query user enumerates sessions. The service is the trick: a Windows service runs as SYSTEM, so starting sesshijack runs tscon with the privilege needed to take over session 1337 without its credentials.

What the SIEM saw

The detonation was graded detected, and the first custom rule fired 2 seconds after the command ran. Two of our lab analytics matched, both at level 12:

This was the first time our Windows E1 rule band (100200–100240) ever fired on a real detonation — the rules had been loaded and reachable for weeks, but nothing had exercised them until this run. Loaded is not the same as proven.

What to hunt for, even without our rules

The real gift to a defender is the telemetry trail. The hijack lit up a clean sequence in Sysmon:

• Sysmon EID 1 — tscon.exe attaching to another session, cmd.exe spawned by an abnormal parent, sc.exe/net.exe creating and starting a service
• Sysmon EID 11 — an executable dropped in a folder commonly abused by malware
• Sysmon EID 13 — a new service registered under HKLM\System\CurrentControlSet\Services\sesshijack\ImagePath with a binary of cmd.exe /k tscon 1337 /dest:rdp-tcp#55

That registry value is the tell. A service whose ImagePath contains tscon and a /dest:rdp-tcp# destination is not something a normal install does — it is a session takeover.

The honest caveat: noise

Detection is not free. In the detonation window the host produced roughly 796 incidental alerts per hour of ordinary background noise. A rule at level 12 cuts through that, but the lesson stands: tune your tscon/service-creation logic against your own baseline before you trust it to page someone.

Grounded in lab run run-2026-10-11-005. The command, the rules and the telemetry above are what the run recorded — see the coverage dashboard for the full run list.