CmdID

CmdID / Commands

qwinsta

Displays information about sessions on a Remote Desktop Session Host server. Windows commands reference

On Windows 2 Sigma rules name it File qwinsta.exe

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0

Displays information about sessions on a Remote Desktop Session Host server. The list includes information not only about active sessions but also about other sessions that the server runs. NOTE: This command is the same as the query session command. To find out what's new in the latest version, see What's New in Remote Desktop Services in Windows Server.

qwinsta [<sessionname> | <username> | <sessionID>] [/server:<servername>] [/mode] [/flow] [/connect] [/counter]
C:>qwinsta
SESSIONNAME USERNAME ID STATE TYPE DEVICE
console Administrator1 0 active wdcon
>rdp-tcp#1 User1 1 active wdtshare
rdp-tcp 2 listen wdtshare
4 idle
5 idle
qwinsta /server:Server2
qwinsta modeM02
<sessionname>Specifies the name of the session that you want to query.
<username>Specifies the name of the user whose sessions you want to query.
<sessionID>Specifies the ID of the session that you want to query.
/server:<servername>Identifies the rd Session Host server to query. The default is the current server.
/modeDisplays current line settings.
/flowDisplays current flow-control settings.
/connectDisplays current connect settings.
/counterDisplays current counters information, including the total number of sessions created, disconnected, and reconnected.
/?Displays help at the command prompt.

What detects it

Sigma process creation rules that name qwinsta
highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
lowLocal Accounts DiscoveryTimur Zinniatullin, Daniil Yugoslavskiy, oscd.community