tscon.exe

File Path: C:\Windows\system32\tscon.exe
Description: Session Connection Utility

Hashes

Type	Hash
MD5	`B792676216706673B65D67916460299F`
SHA1	`7E7351664DAEA80EFCF57C7A55E413C59BF53BA2`
SHA256	`15E3A70FD3F2972CD8D7826DFE4058255B0FBB974969828644D93256F7FB9C12`
SHA384	`314CCDEB1C5DEAF6A7338B28B1D7E5F31E3AE556C2D15968C997EC08D19CD8293276692C52B42530C56C947034FCE623`
SHA512	`7DF72AC370C7AAF81038C013D3A1BA0EF46A3FF9068EF0F6447B93D736E0EC5219C3F7C211C36CBF9CBACAA165860DF9013B997CD89E603B1DF0459CA4EDB17B`
SSDEEP	`384:OqozIUA9aekHHGaNQYlD1eotMT5geGKZ8hYP4No31Rd+3GcJycrceDowLWjdgW:OqoFAweYGaNQ+D1e1yPKZ8PCPo1/DowS`
IMP	`24472C36A35ED9C96546FC249317D860`
PESHA1	`24812B39A048CCA4458F823848E74FF61ED28AC4`
PE256	`63316C1C79174F80D4D068AEF405FF131F3CDD74AE32CF3654039E27FE0CB450`

Runtime Data

Usage (stdout):

Attaches a user session to a remote desktop session.

TSCON {sessionid | sessionname} [/DEST:sessionname]
        [/PASSWORD:pw | /PASSWORD:*] [/V]

  sessionid          The ID of the session.
  sessionname        The name of the session.
  /DEST:sessionname  Connect the session to destination sessionname.
  /PASSWORD:pw       Password of user owning identified session.
  /V                 Displays information about the actions performed.

Usage (stderr):

Invalid parameter(s)
Attaches a user session to a remote desktop session.

TSCON {sessionid | sessionname} [/DEST:sessionname]
        [/PASSWORD:pw | /PASSWORD:*] [/V]

  sessionid          The ID of the session.
  sessionname        The name of the session.
  /DEST:sessionname  Connect the session to destination sessionname.
  /PASSWORD:pw       Password of user owning identified session.
  /V                 Displays information about the actions performed.

Loaded Modules:

Path
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\system32\tscon.exe

Signature

Status: Signature verified.
Serial: 330000023241FB59996DCC4DFF000000000232
Thumbprint: FF82BC38E1DA5E596DF374C53E3617F7EDA36B06
Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

Original Filename: tscon.exe.mui
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
File Version: 10.0.19041.1 (WinBuild.160101.0800)
Product Version: 10.0.19041.1
Language: English (United States)
Legal Copyright: Microsoft Corporation. All rights reserved.
Machine Type: 64-bit

File Scan

VirusTotal Detections: 0/75
VirusTotal Link: https://www.virustotal.com/gui/file/15e3a70fd3f2972cd8d7826dfe4058255b0fbb974969828644d93256f7fb9c12/detection

Possible Misuse

The following table contains possible examples of tscon.exe being misused. While tscon.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source	Source File	Example	License
sigma	proc_creation_win_susp_tscon_localsystem.yml	`title: Suspicious TSCON Start as SYSTEM`	DRL 1.0
sigma	proc_creation_win_susp_tscon_localsystem.yml	`description: Detects a tscon.exe start as LOCAL SYSTEM`	DRL 1.0
sigma	proc_creation_win_susp_tscon_localsystem.yml	`Image\\|endswith: '\tscon.exe'`	DRL 1.0
sigma	proc_creation_win_susp_tscon_rdp_redirect.yml	`title: Suspicious RDP Redirect Using TSCON`	DRL 1.0
sigma	proc_creation_win_susp_tscon_rdp_redirect.yml	`description: Detects a suspicious RDP session redirect using tscon.exe`	DRL 1.0
atomic-red-team	T1563.002.md	Adversaries may perform RDP session hijacking which involves stealing a legitimate user’s remote session. Typically, a user is notified when someone else is trying to steal their session. With System permissions and using Terminal Services Console, `c:\windows\system32\tscon.exe [session number to be stolen]`, an adversary can hijack a session without the need for credentials or prompts to the user.(Citation: RDP Hijacking Korznikov) This can be done remotely or locally and with active or disconnected sessions.(Citation: RDP Hijacking Medium) It can also lead to Remote System Discovery and Privilege Escalation by stealing a Domain Admin or higher privileged account session. All of this can be done by using native Windows commands, but it has also been added as a feature in red teaming tools.(Citation: Kali Redsnarf)</blockquote>	MIT License. © 2018 Red Canary
atomic-red-team	T1563.002.md	sc.exe create sesshijack binpath= “cmd.exe /k tscon #{Session_ID} /dest:#{Destination_ID}”	MIT License. © 2018 Red Canary

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

tscon

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Connects to another session on a Remote Desktop Session Host server.

[!IMPORTANT] You must have Full Control access permission or Connect special access permission to connect to another session.

[!NOTE] To find out what’s new in the latest version, see What’s New in Remote Desktop Services in Windows Server.

Syntax

tscon {<sessionID> | <sessionname>} [/dest:<sessionname>] [/password:<pw> | /password:*] [/v]

Parameters

Parameter	Description
`<sessionID>`	Specifies the ID of the session to which you want to connect. If you use the optional `/dest:<sessionname>` parameter, you can also specify the name of the current session.
`<sessionname>`	Specifies the name of the session to which you want to connect.
/dest:`<sessionname>`	Specifies the name of the current session. This session will disconnect when you connect to the new session. You can also use this parameter to connect the session of another user to a different session.
/password:`<pw>`	Specifies the password of the user who owns the session to which you want to connect. This password is required when the connecting user does not own the session.
/password:`*`	Prompts for the password of the user who owns the session to which you want to connect.
/v	Displays information about the actions being performed.
/?	Displays help at the command prompt.

Remarks

This command fails if you don’t specify a password in the /password parameter, and the target session belongs to a user other than the current one.
You can’t connect to the console session.

Examples

To connect to Session 12 on the current Remote Desktop Services Session Host server, and to disconnect the current session, type:

tscon 12

To connect to Session 23 on the current Remote Desktop Services Session Host server using the password mypass, and to disconnect the current session, type:

tscon 23 /password:mypass

To connect the session named TERM03 to the session named TERM05, and then to disconnect session TERM05, type:

tscon TERM03 /v /dest:TERM05