CmdID

CmdID / Files

tscon.exe

Session Connection Utility file version info

Program on Windows 9 known copies with hashes 2 Sigma rules name it Command tscon

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real tscon.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSession Connection Utility

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\tscon.exe · signed by Microsoft Windows

c312d4d59166c44d0adff0dd6a382b33c23db0e45d11f66fb4262cd055a474e9

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\tscon.exe · signed by Microsoft Windows

15e3a70fd3f2972cd8d7826dfe4058255b0fbb974969828644d93256f7fb9c12

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\tscon.exe · signed by Microsoft Windows

ec0e8104cec80f4503fc1776f03b20d124a83ab3268968f3f1de54fac443f0b0

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\tscon.exe · signed by Microsoft Windows

2877e57b2490f708413b93d8e8ccfab21542bf4f7d5ef582c995fb3059e2dbdd

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\tscon.exe · signed by Microsoft Windows

b0837a65f983bf6c8d06e695ad60977f141066f1c8cb84753e75f96b9faee66c

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\tscon.exe · signed by Microsoft Windows

71b4bc48247fbba8e3d442e8043b93daeb1c75c46e35072b832a84828671ac19

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\tscon.exe · signed by Microsoft Windows

bdc8ada1c5f994a656a8b79bdb7a9f9935b5e49172fcd744b46cf78ed706d47b

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\tscon.exe · not signed

95070392da581b473096bb3fdf3cd8d6093ed027fcac12f216f57f8d14deb15e

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\tscon.exe · not signed

9a47aafc2c4104733bd3c6d7f8458d1f7669496df2c0eabc2c8d0be75feeb129

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name tscon.exe
highSuspicious TSCON Start as SYSTEMFlorian Roth (Nextron Systems)
mediumPotential RDP Session Hijacking Activity@juju4