Potential RDP Session Hijacking via tscon.exe with System Integrity
This rule detects the execution of 'tscon.exe' with 'System' integrity level. This combination is indicative of potential RDP session hijacking activity, where an attacker takes over an existing RDP session without needing credentials or prompting the user. The 'tscon.exe' utility is a legitimate Windows tool used to connect to or disconnect from a session on a Remote Desktop Session Host server, but its execution with System integrity is a strong indicator of malicious intent in this context.
Sigma
