a guest Feb 21st, 2019 568 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. title: Hijack legit RDP session to move laterally  
  2. status: experimental
  3. description: Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder
  4. date: 2019/02/21
  5. author: Samir Bousseaden
  6. logsource:
  7.     product: windows
  8.     service: sysmon
  9. detection:
  10.     selection:
  11.         EventID: 11
  12.         Image: '*\mstsc.exe'
  13.         TargetFileName: '*\Microsoft\Windows\Start Menu\Programs\Startup\*'
  14.     condition: selection
  15. falsepositives:
  16.     - unknown
  17. level: high
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand