How do you detect RDP lateral movement?

Detect RDP lateral movement by baselining source-to-destination pairs. Event ID 4624 logon type 10 on the destination and Event 1149 in the TerminalServices-RemoteConnectionManager log both record the source address; alert when the source is not an approved jump host or admin workstation and when one source reaches several hosts. Treat a loopback source as a likely tunnel. For session hijacking, alert on tscon.exe with /dest: run as SYSTEM, correlated with a service install that preceded it. Restrict inbound 3389 to jump hosts and enable NLA so legitimate use is narrow and your allowlist is accurate.

Detecting RDP Lateral Movement and Session Hijacking

RDP is the most common interactive lateral movement path because it is allowed almost everywhere. It also produces some of the best-structured Windows telemetry: logon events, a pre-logon network authentication event and session lifecycle events. Detection comes from the source-to-destination pair, not from RDP itself.

Signals at a Glance

Signal	Where	ATT&CK
Type 10 (RemoteInteractive) logon from a workstation or server that is not an admin host	Event 4624	T1021.001
Network authentication succeeded with source address, before the logon	TerminalServices-RemoteConnectionManager 1149	T1021.001
Session logon, shell start and reconnect	LocalSessionManager 21, 22, 25	T1021.001
tscon.exe with /dest: run as SYSTEM to take over another session	Sysmon 1, Event 4688	T1563.002
One source opening RDP to many hosts, or RDP through a port forward or tunnel	Zeek conn.log, firewall	T1572

Source and Destination Pairs

Event 4624 type 10 on the destination carries the source address; Event 1149 in the TerminalServices-RemoteConnectionManager log records the user, domain and source address of the network authentication even when the logon later fails. Join those with a list of approved sources (jump hosts, PAWs) and alert on everything else:

index=wineventlog EventCode=4624 Logon_Type=10
| lookup rdp_approved_sources ip AS Source_Network_Address OUTPUT ip AS approved
| where isnull(approved)
| stats dc(ComputerName) AS dest_count values(ComputerName) AS dests
        earliest(_time) AS first latest(_time) AS last
        by Account_Name, Source_Network_Address
| eval severity=if(dest_count >= 3, "high", "medium")
| sort - dest_count
# tune/validate: rdp_approved_sources is a lookup you own; exclude 127.0.0.1 and ::1 as a separate
# hunt because a loopback source can indicate an RDP tunnel.

A loopback or the destination’s own address as the RDP source suggests a tunnel (SSH, chisel, ngrok-style) forwarding traffic. Treat it as a separate, high-confidence hunt.

tscon Session Hijacking

The built-in tscon.exe lets a SYSTEM-level process attach to another user’s session without that user’s password. Attackers obtain SYSTEM through a temporary service, then run tscon <id> /dest:<session>. Legitimate use is rare, so the rule is simple:

title: tscon Session Hijack
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\tscon.exe'
    CommandLine|contains: '/dest:'
  system_user:
    User|contains:
      - 'AUTHORITY\SYSTEM'
      - 'AUTORITE NT\Système'
  condition: selection and system_user
level: high
# tune/validate: confirm your process-creation source populates the User field.

Correlate with a service install (Event 7045) that ran cmd.exe just before tscon.exe; that is the usual route to SYSTEM.
Enable Network Level Authentication and restrict inbound 3389 to jump hosts with host firewall rules; the rule set then doubles as a detection allowlist.
Alert on RDP session reconnects (LocalSessionManager 25) from a source that differs from the original session source.

Vetted sources

Use the SigmaHQ RDP, tscon and RDP-tunnelling rules, Elastic and Splunk ESCU remote-desktop content and MITRE CAR analytics for RDP. Zeek ships an rdp.log that covers hosts without full Windows auditing, and Atomic Red Team includes RDP hijack tests. Baseline your own environment: helpdesk and server-administration teams legitimately RDP broadly.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Source and Destination Pairs

tscon Session Hijacking

Build Detections That Fire

Lateral Movement Detection

Detection Hub

WinRM Lateral Movement Detection

Lateral Movement Graphing