RDP Session Hijacking

An attacker with SYSTEM privileges on a Windows host can attach to another user’s existing Remote Desktop session — without credentials and without prompting the user — using the Terminal Services Console utility tscon.exe. MITRE ATT&CK catalogs this as T1563.002 — Remote Service Session Hijacking: RDP Hijacking.

Prerequisites

• SYSTEM-level execution on the target (e.g., via psexec: PsExec64.exe -s cmd.exe)
• A target session to steal — disconnected sessions (shown as Disc in session listings) are ideal because no active user is kicked off mid-action
• Historically reliable on Windows Server 2016 and earlier; newer versions still permit it from SYSTEM, though session isolation and credential guard features change behavior

Walkthrough

Enumerate sessions from an administrative terminal:

query user

Note the target session’s ID (for a disconnected session) and your own session name (e.g., rdp-tcp#5). Then, from a SYSTEM terminal:

tscon $SESSION_ID /dest:$OUR_SESSION_NAME

tscon connects your console to the target session — you inherit the victim’s desktop exactly as they left it, including unlocked credentials, open applications, and authenticated sessions in browsers.

Defense (per MITRE)

• M1042 — Disable the RDP service where unnecessary
• M1028 — GPO: shorten session timeouts and cap how long disconnected sessions persist on the RD session host
• Detection (DET0588) — alert on tscon.exe execution, session reassignments without corresponding authentication events, and processes spawning in the context of hijacked sessions
• Disconnected-session hygiene also limits exposure: logged-out sessions can’t be stolen — see rdp-restricted-admin-mode for a related hardening control

Sources

• MITRE ATT&CK T1563.002 — RDP Hijacking
• MITRE ATT&CK T1563 — Remote Service Session Hijacking
• Microsoft Learn — tscon command reference

Related: psexec, xfreerdp, rdp-restricted-admin-mode, windows-event-logs