CmdID

CmdID / Commands

tscon

Connects to another session on a Remote Desktop Session Host server. Windows commands reference

On Windows 2 Sigma rules name it File tscon.exe

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0

Connects to another session on a Remote Desktop Session Host server. IMPORTANT: You must have Full Control access permission or Connect special access permission to connect to another session. NOTE: To find out what's new in the latest version, see What's New in Remote Desktop Services in Windows Server.

tscon {<sessionID> | <sessionname>} [/dest:<sessionname>] [/password:<pw> | /password:*] [/v]

To connect to Session 12 on the current Remote Desktop Services Session Host server, and to disconnect the current session, type

tscon 12Identify

To connect to Session 23 on the current Remote Desktop Services Session Host server using the password mypass, and to disconnect the current session, type

tscon 23 /password:mypassIdentify
/passwordSpecifies the password of the user who owns the session to which you want to connect. Windows commands reference

To connect the session named TERM03 to the session named TERM05, and then to disconnect session TERM05, type

tscon TERM03 /v /dest:TERM05Identify
/vDisplays information about the actions being performed. Windows commands reference
/destSpecifies the name of the current session. Windows commands reference
<sessionID>Specifies the ID of the session to which you want to connect. If you use the optional /dest:<sessionname> parameter, you can also specify the name of the current session.
<sessionname>Specifies the name of the session to which you want to connect.
/dest:<sessionname>Specifies the name of the current session. This session will disconnect when you connect to the new session. You can also use this parameter to connect the session of another user to a different session.
/password:<pw>Specifies the password of the user who owns the session to which you want to connect. This password is required when the connecting user does not own the session.
/password:*Prompts for the password of the user who owns the session to which you want to connect.
/vDisplays information about the actions being performed.
/?Displays help at the command prompt.

What detects it

Sigma process creation rules that name tscon
highSuspicious TSCON Start as SYSTEMFlorian Roth (Nextron Systems)
mediumPotential RDP Session Hijacking Activity@juju4