CmdID

CmdID / Commands

mstsc

Creates connections to Remote Desktop Session Host servers or other remote computers and edits an existing Remote Desktop Connection (.rdp) configuration file. Windows commands reference

On Windows 4 Sigma rules name it File mstsc.exe

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0
mstsc.exe [<connectionfile>] [/v:<server>[:<port>]] [/g:<gateway>] [/admin] [/f[ullscreen]] [/w:<width> /h:<height>] [/public] [/span] [/multimon] [/l] [/restrictedAdmin] [/remoteGuard] [/prompt] [/shadow:<sessionID> [/control] [/noConsentPrompt]]
mstsc.exe /edit <connectionfile>
mstsc /f
mstsc /v:computer1 /fullscreen
mstsc /v:computer1 /span
mstsc /v:computer1 /w:1920 /h:1080
mstsc /edit filename.rdp
Show 19 options
<connectionfile>Specifies the name of an .rdp file for the connection.
/v:<server>[:<port>]Specifies the remote computer and, optionally, the port number to which you want to connect.
/g:<gateway>Specifies the RD Gateway server to use for the connection. The command only reads this parameter when you specify the endpoint PC with /v.
/adminConnects you to a session for administering the server.
/f[ullscreen]Starts Remote Desktop Connection in full-screen mode. /f and /fullscreen are equivalent.
/w:<width>Specifies the width of the Remote Desktop window.
/h:<height>Specifies the height of the Remote Desktop window.
/publicRuns Remote Desktop in public mode. In public mode, Remote Desktop doesn't cache passwords and bitmaps.
/spanMatches the Remote Desktop width and height to the local virtual desktop and spans the Remote Desktop session across multiple monitors. The monitors must have the same resolution and be aligned horizontally (side by side). This parameter differs from /multimon, which mirrors the client-side monitor layout instead of spanning a single desktop.
/multimonConfigures the Remote Desktop Services session monitor layout to be identical to the current client-side configuration.
/lEnumerates the monitors attached to the local PC and the ID associated with each monitor. You can use the monitor IDs to populate the selectedmonitors RDP file setting.
/edit <connectionfile>Opens the specified .rdp file for editing.
/restrictedAdminThis mode won't send your credentials to the remote PC, which can protect you if you connect to a compromised device. Other PCs might not authenticate connections from the remote PC, which affects application functionality and compatibility. This mode implies the /admin parameter.
/remoteGuardThis mode prevents the command from sending your credentials to the remote PC, which can help protect your credentials if you connect to a compromised device. Unlike Restricted Administrator mode, Remote Guard also supports connections from the remote PC by redirecting all requests back to your device.
/promptPrompts you for your credentials when you connect to the remote PC.
/shadow:<sessionID>Specifies the ID of the session to shadow.
/controlAllows control of the session when shadowing.
/noConsentPromptAllows shadowing without user consent.
/?Shows the Remote Desktop Connection Usage dialog box.

What detects it

Sigma process creation rules that name mstsc
highMstsc.EXE Execution From Uncommon ParentNasreddine Bencherchali (Nextron Systems)
highSuspicious Mstsc.EXE Execution With Local RDP FileNasreddine Bencherchali (Nextron Systems)
mediumNew Remote Desktop Connection Initiated Via Mstsc.EXEfrack113
lowMstsc.EXE Execution With Local RDP FileNasreddine Bencherchali (Nextron Systems), Christopher Peacock @securepeacock