mstsc.exe
- File Path:
C:\WINDOWS\SysWOW64\mstsc.exe - Description: Remote Desktop Connection
Screenshot
Hashes
| Type | Hash |
|---|---|
| MD5 | DD0EF229C4D9C47A188082F6AE032A1B |
| SHA1 | C8209B3FF060F0B2BFF0E886393484A982459880 |
| SHA256 | C162AD2306001B99CF2CBD7BB9E0EA274C890D6DB2294CF6A517D66303C4B268 |
| SHA384 | 90C26B1D5DB6C60D1FFCCBA95ED9C559450D761087BAE989D2212458C572811C3DA3CF6848936A1E12C1FF527C018F0E |
| SHA512 | 107550415C49EAA31BD66EA9DF350E5A7EE7CBDE9CF20E7B455D3A6F3E2108D0D713CBDC14B74FB52937316D9DA40C5144332A11EE3BE6CF8EE04F121F5AA9BA |
| SSDEEP | 24576:dp508zbSQLYjEBYswH1SVfZd4Ah3P2dKnm2HzSKST2EOt9HCssfN62E:dX0jjxmzOH61 |
Runtime Data
Child Processes:
mstsc.exe
Signature
- Status: Signature verified.
- Serial:
330000023241FB59996DCC4DFF000000000232 - Thumbprint:
FF82BC38E1DA5E596DF374C53E3617F7EDA36B06 - Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
File Metadata
- Original Filename: mstsc.exe
- Product Name: Microsoft Windows Operating System
- Company Name: Microsoft Corporation
- File Version: 10.0.18362.752 (WinBuild.160101.0800)
- Product Version: 10.0.18362.752
- Language: English (United States)
- Legal Copyright: Microsoft Corporation. All rights reserved.
Possible Misuse
The following table contains possible examples of mstsc.exe being misused. While mstsc.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.
| Source | Source File | Example | License |
|---|---|---|---|
| sigma | file_event_win_tsclient_filewrite_startup.yml | Image\|endswith: '\mstsc.exe' |
DRL 1.0 |
| sigma | net_connection_win_susp_rdp.yml | - '\mstsc.exe' |
DRL 1.0 |
| sigma | proc_creation_win_mimikatz_command_line.yml | - 'mstsc' #ts module |
DRL 1.0 |
| sigma | proc_creation_win_mstsc.yml | title: Remote Desktop Protocol Use Mstsc |
DRL 1.0 |
| sigma | proc_creation_win_mstsc.yml | - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/mstsc |
DRL 1.0 |
| sigma | proc_creation_win_mstsc.yml | Image\|endswith: \mstsc.exe |
DRL 1.0 |
| sigma | proc_creation_win_rdp_hijack_shadowing.yml | title: MSTSC Shadowing |
DRL 1.0 |
| sigma | proc_creation_win_rdp_hijack_shadowing.yml | description: Detects RDP session hijacking by using MSTSC shadowing |
DRL 1.0 |
| sigma | registry_event_mstsc_history_cleared.yml | description: Detects the deletion of registry keys containing the MSTSC connection history |
DRL 1.0 |
| atomic-red-team | T1021.001.md | mstsc /v:$Server | MIT License. © 2018 Red Canary |
| atomic-red-team | T1021.001.md | $p=Tasklist /svc /fi “IMAGENAME eq mstsc.exe” /fo csv | convertfrom-csv | MIT License. © 2018 Red Canary |
| signature-base | cn_pentestset_tools.yar | $s1 = “srv\newclient\lib\win32\obj\i386\mstsc.pdb” fullword ascii | CC BY-NC 4.0 |
| signature-base | crime_cn_campaign_njrat.yar | $a2 = “taskkill /f /im mstsc.exe” fullword ascii | CC BY-NC 4.0 |
Additional Info*
*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.
mstsc
Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012
Creates connections to Remote Desktop Session Host servers or other remote computers, edits an existing Remote Desktop Connection (.rdp) configuration file, and migrates legacy connection files that were created with Client Connection Manager to new .rdp connection files.
Syntax
mstsc.exe [<connectionfile>] [/v:<server>[:<port>]] [/admin] [/f] [/w:<width> /h:<height>] [/public] [/span]
mstsc.exe /edit <connectionfile>
mstsc.exe /migrate
Parameters
| Parameter | Description |
|---|---|
<connectionfile> |
Specifies the name of an .rdp file for the connection. |
/v:<server>[:<port>] |
Specifies the remote computer and, optionally, the port number to which you want to connect. |
| /admin | Connects you to a session for administering the server. |
| /f | Starts Remote Desktop Connection in full-screen mode. |
/w:<width> |
Specifies the width of the Remote Desktop window. |
/h:<height> |
Specifies the height of the Remote Desktop window. |
| /public | Runs Remote Desktop in public mode. In public mode, passwords and bitmaps aren’t cached. |
| /span | Matches the Remote Desktop width and height with the local virtual desktop, spanning across multiple monitors if necessary. |
/edit <connectionfile> |
Opens the specified .rdp file for editing. |
| /migrate | Migrates legacy connection files that were created with Client Connection Manager to new .rdp connection files. |
| /? | Displays help at the command prompt. |
Remarks
-
Default.rdp is stored for each user as a hidden file in the user’s Documents folder.
-
User created .rdp files are saved by default in the user’s Documents folder, but can be saved anywhere.
-
To span across monitors, the monitors must use the same resolution and must be aligned horizontally (that is, side-by-side). There is currently no support for spanning multiple monitors vertically on the client system.
Examples
To connect to a session in full-screen mode, type:
mstsc /f
or
mstsc /v:computer1 /f
To assign width/height, type:
mstsc /v:computer1 /w:1920 /h:1080
To open a file called filename.rdp for editing, type:
mstsc /edit filename.rdp
Additional References
MIT License. Copyright (c) 2020-2021 Strontic.