ATT&CK technique
View on MITRE ATT&CK →
T1563.002
RDP Hijacking
Lateral Movement
5 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Windows Service Create with Tscon | production | 2026-10-02 |
| elastic | Potential Remote Desktop Shadowing Activity | production | 2026-09-18 |
| splunk | Windows RDP Connection Successful | production | 2026-05-13 |
| sigma | Suspicious RDP Redirect Using TSCON | test | 2023-05-16 |
| sigma | Potential MSTSC Shadowing Activity | test | 2023-02-05 |