{
  "Name": "mstsc.exe (Microsoft Remote Desktop Connection)",
  "Category": "RAT",
  "Description": "mstsc.exe is the built-in Microsoft Remote Desktop Connection (RDC) client\nthat ships with all supported Windows versions. The \"MSTSC\" name is a\nhistorical acronym for \"Microsoft Terminal Services Client\" — the product\nwas renamed from Terminal Services to Remote Desktop Services, but the\nbinary kept the original name. It is signed by Microsoft and located in\n%SystemRoot%\\System32\\mstsc.exe. Adversaries abuse the native RDP client\nfor interactive lateral movement (T1021.001) and as a living-off-the-land\nremote-access pathway because it is present, signed, and frequently\nallow-listed in enterprise environments. This entry consolidates the\nprevious duplicate entries \"Microsoft RDP\" and \"Microsoft TSC\", which\ndescribed the same binary under different names.\n\n**IMPORTANT**: This tool is signed with legitimate Microsoft Corporation\ncertificates that are also used to sign numerous other Microsoft products\nand Windows components. Do NOT blindly block these certificate thumbprints\nas doing so will break essential Windows functionality and other Microsoft\napplications in your environment. Use certificate data for detection,\nhunting, and analysis purposes only.\n",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2026-05-04",
  "Details": {
    "Website": "https://learn.microsoft.com/windows-server/administration/windows-commands/mstsc",
    "PEMetadata": {
      "Filename": "mstsc.exe",
      "OriginalFileName": "mstsc.exe",
      "Description": "Remote Desktop Connection"
    },
    "Privileges": "User",
    "Free": true,
    "Verification": true,
    "SupportedOS": [
      "Windows"
    ],
    "Capabilities": [
      "Interactive remote desktop session over RDP",
      "Connection profile management via .rdp files",
      "Session shadowing (/shadow, /control)",
      "Restricted Admin and Remote Guard credential-protection modes"
    ],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "C:\\Windows\\System32\\mstsc.exe",
      "*Windows\\System32\\mstsc.exe"
    ]
  },
  "Artifacts": {
    "Disk": [
      {
        "File": "%USERPROFILE%\\Documents\\Default.rdp",
        "Description": "Hidden default RDP connection profile created by mstsc.exe.",
        "OS": "Windows"
      },
      {
        "File": "%SystemRoot%\\System32\\termsrv.exe",
        "Description": "Server-side Terminal Services / Remote Desktop Services host service that listens for inbound mstsc.exe sessions on TCP/3389. Present on the destination, not the client originating the connection.",
        "OS": "Windows"
      }
    ],
    "EventLog": [],
    "Registry": [
      {
        "Path": "HKCU\\Software\\Microsoft\\Terminal Server Client\\Default",
        "Description": "Most-recently-used (MRU) list of remote hosts connected to via mstsc.exe."
      },
      {
        "Path": "HKCU\\Software\\Microsoft\\Terminal Server Client\\Servers",
        "Description": "Per-host subkeys recording usernames and gateway hints used by mstsc.exe."
      }
    ],
    "Network": [
      {
        "Description": "RDP traffic initiated by mstsc.exe to a Remote Desktop Session Host or RD Gateway",
        "Domains": [],
        "Ports": [
          3389
        ]
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/mstsc_processes_sigma.yml",
      "Description": "Detects potential process activity of the mstsc.exe Remote Desktop Connection client."
    }
  ],
  "References": [
    "https://learn.microsoft.com/windows-server/administration/windows-commands/mstsc",
    "https://learn.microsoft.com/windows-server/administration/windows-commands/remote-desktop-services-terminal-services-command-reference",
    "https://learn.microsoft.com/troubleshoot/windows-server/remote/terminal-server-startup-connection-application",
    "https://learn.microsoft.com/en-us/previous-versions/remote-desktop-client/remote-desktop-windows-urdc",
    "https://attack.mitre.org/techniques/T1021/001/"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "search_names": [
      "mstsc.exe"
    ],
    "company_names": [],
    "signer_names": [
      "Microsoft Corporation",
      "Power Software Limited"
    ],
    "certificates": [
      {
        "signer_name": "Power Software Limited",
        "certificate_thumbprint": "C8DB5C8424B346AD72D19F40BD63B5EC0C84E677",
        "tbs_sha256": "7EDC698ACA865B764240F7E971A1E37480B92A0732889616343B31590D2A9E24",
        "tbs_sha1": "",
        "certificate_der_base64": "MIIE4TCCA8mgAwIBAgIQGepNrwiVcIYUCOnwXv2biTANBgkqhkiG9w0BAQsFADB/MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxMDAuBgNVBAMTJ1N5bWFudGVjIENsYXNzIDMgU0hBMjU2IENvZGUgU2lnbmluZyBDQTAeFw0yMDAxMjAwMDAwMDBaFw0yMzAzMTUyMzU5NTlaMHkxCzAJBgNVBAYTAkhLMRIwEAYDVQQIDAlIT05HIEtPTkcxFDASBgNVBAcMC05PUlRIIFBPSU5UMR8wHQYDVQQKDBZQb3dlciBTb2Z0d2FyZSBMaW1pdGVkMR8wHQYDVQQDDBZQb3dlciBTb2Z0d2FyZSBMaW1pdGVkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtI0+lymUo/vaA22OwEfmMNScDHmbk7Ppwyx8HI7pVznoOlSedIPP+m6EUPrRERj8xMFlr7MYMzIfC+H53dwC3+dLozr5kAddmyJilrBEsv2d8S4paHE5fevFeooVdHZ89D4oDQgj4wvR8SdzKJiA463wLiB8x9SYhcdp/VFEeGuRwoTEdr2RWL59yeQpRRZNcWNYkjGhCz5oHCF0HU/MUdMWJTONVgRPzTVIC7JTy4AbCDAvARwhgKK2qiZylSGgV2+x+kPCC7KRKFPrzVZ7mQ6iHwTTmKFxxm4i6MnNle20uDhiTQ7nyheRbCrv/pSOLl/s4rTWAytX3LJkDne04QIDAQABo4IBXTCCAVkwCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCB4AwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL3N2LnN5bWNiLmNvbS9zdi5jcmwwYQYDVR0gBFowWDBWBgZngQwBBAEwTDAjBggrBgEFBQcCARYXaHR0cHM6Ly9kLnN5bWNiLmNvbS9jcHMwJQYIKwYBBQUHAgIwGQwXaHR0cHM6Ly9kLnN5bWNiLmNvbS9ycGEwEwYDVR0lBAwwCgYIKwYBBQUHAwMwVwYIKwYBBQUHAQEESzBJMB8GCCsGAQUFBzABhhNodHRwOi8vc3Yuc3ltY2QuY29tMCYGCCsGAQUFBzAChhpodHRwOi8vc3Yuc3ltY2IuY29tL3N2LmNydDAfBgNVHSMEGDAWgBSWO1PweTOXr32D7y4rzMq3hh5yZjAdBgNVHQ4EFgQUskGTGQqdk7ut9hoEblovZDT0HnIwDQYJKoZIhvcNAQELBQADggEBAF3B1XcBFdaH7zMHhMdJLyIdFDSR5ZHw57dtFisPBdezX71YY/+eGkintSMAw6AeLy35wbu0MlNFe1InrJ9zMHOUrbmjY17BC65Tmiz97PcGYSjbgC/1gZHAQx3OIiL46h6NdBq4BqvqxGdATtPdIUtMcMhzQVLAGycCUzEdQsWLXMB46BDm0QdkMc0sqYPyzsdjmKW+t35h0nBwqIoeGjFjKcyBDu75tiz1YaqSfHyltDMu9yH41XhaiSQpzIihhAeRYv8VzWpDZ7m9TNh6dYiMyGFrU+pn29ocKS3xezKHKaFRtFooZ029rcWQTWfUSoXdXsY3P1yHCdhvD1ggOmY="
      },
      {
        "signer_name": "Microsoft Corporation",
        "issuer": "CN=Microsoft Code Signing PCA 2011",
        "certificate_thumbprint": "8F985BE8FD256085C90A95D3C74580511A1DB975",
        "tbs_sha256": "3D7ECEA41F3A81E648E26BF630378BE677204330A6A7C3E6E6971A2B6C3B9C0D",
        "tbs_sha1": "C71EABE2369212728EF4949B59A97A345FBF6CAE",
        "valid_from": "2024-09-12T20:11:14+00:00",
        "valid_to": "2025-09-11T20:11:14+00:00",
        "certificate_der_base64": "MIIF9DCCA9ygAwIBAgITMwAABARsdAb/VysncgAAAAAEBDANBgkqhkiG9w0BAQsFADB+MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYDVQQDEx9NaWNyb3NvZnQgQ29kZSBTaWduaW5nIFBDQSAyMDExMB4XDTI0MDkxMjIwMTExNFoXDTI1MDkxMTIwMTExNFowdDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEeMBwGA1UEAxMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtCg32mOdDA6rBBnZSMwxwXegqiDEUFlvQH9Sxww07hY3w7L52tJxLg0mCZjcszQddI6W4NJYb5E9QM319kyyE0l8EvA/pgcxgljDP8E6XIlgVf6W40ms286Cr0azaA1f7vaJjjNhGsMqOSSSXTZDNnfKs5ENG0bkXeB2q5hrp0qLsm/TWO3oFjeROZVHN2tgETswHR3WKTm6QjnXgGNj+V6rSZJO/WkTqc8NesAo3Up/KjMwgc0e67x9llZLxRyyMWUBE9coT2+pUZqYAUDZ84nR1djnMY3PMDYiA84Gw5JpceeED38O0cEIvKdX8uG8oQa047+evMfDRr94MG9EWwIDAQABo4IBczCCAW8wHwYDVR0lBBgwFgYKKwYBBAGCN0wIAQYIKwYBBQUHAwMwHQYDVR0OBBYEFPIboTWxEw1PmVpZS+AzTDwooxFOMEUGA1UdEQQ+MDykOjA4MR4wHAYDVQQLExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFjAUBgNVBAUTDTIzMDAxMis1MDI5MjMwHwYDVR0jBBgwFoAUSG5k5VAF04KqFzc3IrVtqMp1ApUwVAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljQ29kU2lnUENBMjAxMV8yMDExLTA3LTA4LmNybDBhBggrBgEFBQcBAQRVMFMwUQYIKwYBBQUHMAKGRWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY2VydHMvTWljQ29kU2lnUENBMjAxMV8yMDExLTA3LTA4LmNydDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQCI5g/SKUFb3wdUHob6Qhnu0Hk0JCkO4925gzI8EqhS+K4umnvSBU3acsJ+bJprUiMimA59/5x7WhJ9F9TQYy+aD9AYwMtbKsQ/rst+QflfML+Rq8YTAyT/JdkIy7R/1IJUkyIS6srfG1AKlX8n6YeAjjEb8MI07wobQp1F1wArgl2B1mpTqHNDlNqBjfpjySCScWjUHNbIwbDGxiFr93JoEh5AhJqzL+8monaXj7elfsjzIpPnl8NyH2eXjTojYC9a2c4EiX0571KomhENF3RtR25A7/X7+gk6upuE8tyMy4sBkl2MUSF08U+E2LOVcR8trhYxV1lUi9CdgEU2CxODspdcFwxdT1+G8YNcgzHyjx3BNSI4nOZcdSnStUpGhCXbaOIXfvtOSfQX/UwJoruhCugvTnub0Wna6CQiturglCOMyIy/6hu5rMFvqk9AltIJ0fSR5FwljW6PHHDJNbCWrZkaEgIn24M2mG1M/Ppb/iF8uRhbgJi5zWxo2nAdyDBqWvpWxYIoee/3yIWpquVYcYGhJp/1I1sq/nD4gBVrk1SKX7Do2xAMMO+cFETTNSJqfTSSsntTtuBLKRB5mw5qglHKuzapDiiBuD1Zt4QwxA/1kKcyQ5L7uBayG78kxlVNNbyrIOFH3HYmdH0Pv1dIX/Mq7avQpAfIiLpOWwcbjw=="
      },
      {
        "signer_name": "win.rar GmbH",
        "certificate_thumbprint": "729AE1F8B489DE176CC099FF49937F85F9E412F7",
        "certificate_der_base64": "MIIHWDCCBUCgAwIBAgIQBIsIOZ7HA2I8cs0gd61l2TANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTIzMDgwODAwMDAwMFoXDTI2MDgwNzIzNTk1OVowgeAxEzARBgsrBgEEAYI3PAIBAxMCREUxFzAVBgsrBgEEAYI3PAIBAhMGQmVybGluMR8wHQYLKwYBBAGCNzwCAQETDkNoYXJsb3R0ZW5idXJnMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjETMBEGA1UEBRMKSFJCIDEwOTg4NTELMAkGA1UEBhMCREUxDzANBgNVBAgTBkJlcmxpbjEPMA0GA1UEBxMGQmVybGluMRUwEwYDVQQKEwx3aW4ucmFyIEdtYkgxFTATBgNVBAMTDHdpbi5yYXIgR21iSDCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAJrNBWkLzla3tj9bhusRhk6ZzgzcgNHbZRI9nSX1/buowo4BjwCRFy7zTVQ9WNey9ghE8mbY8zhPgARuICPibaP19oFySzXSxG0QJWzi/HC50S6r0skMKDR42RBM7KcEazmfmp9RCnNjIJiaINa8RUpS+SuhmUl/iIOr9rHrEE/JGWoS8Ft9XDXwS2CacetaAcdyvKD9QQRoWu0yOkM/CaS1kHIVAayqta7rZvaBcs6SyLT2aR+0cWHcmH++2H2q37KbUcSEopNffmpU3M74Lcm2uckQgjsjEwmNfgLeLLntTx8yn7bfh4ZNNytn6bX2U0zufBJbKehAH6Zfww/aFAH0wsP1148R7pPGoXG4AeyXATWn7ufbWytTrgR8aNvsuS8h3mmUGV6mSNaxGszALQ0KxKAsTpoFVVsz86yVYL/IK9wuq9ogAheDeLR1v7leLbwJsqLRi0Ry8uyX7szJF5i+puSdqGz+lx6FcR2VsD8vnPOVC3Wtq2UgEKZs/0zP0wIDAQABo4ICAjCCAf4wHwYDVR0jBBgwFoAUaDfg67Y7+F8Rhvv+YXsIiGX0TkIwHQYDVR0OBBYEFFhcVBV2Psfb2Ad3xaRy9ZeAf4cTMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzCBtQYDVR0fBIGtMIGqMFOgUaBPhk1odHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNybDBToFGgT4ZNaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwPQYDVR0gBDYwNDAyBgVngQwBAzApMCcGCCsGAQUFBwIBFhtodHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwgZQGCCsGAQUFBwEBBIGHMIGEMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wXAYIKwYBBQUHMAKGUGh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3J0MAkGA1UdEwQCMAAwDQYJKoZIhvcNAQELBQADggIBAMQeLwDoY491d3YPbv8Zh5MBMGxgKM4gPL05+gkTSP3UhXVE/ydaCKYtrINTYDHM+SxOb4GcAJZ35YC9G5A9nocvQhyDiQ5I12RccOQ7heNq4h2NgxbShNLgXMZgv1E7fx2J7U7u2DnJK+c4dYADKYLZdQjO3nIojrfR9z6Fg1qaPFQQqkVmudthB5/0kYcOxPucbFlKpFoY6M88ZzOKCRLUYtvXs4nYRggG25VoNLtpLjLXCjmQ0wQ/28QZYtIq7mW+Jfc1vPOiEmPzX6t7X626ulBKCIL/MV5mBeag+0P7vTT+QWQef1v7npeWOSljVv84k7h7HzPn+c208FwNSrPGFBJ7M2HiY1TGUYtCzLHeSNKykvWpp+ALyKQtueN9fJYBLc8DS7aYJvtx3saVysRzHP+4oDZuEtb3hjfSBjAZq20ohXsbNtepSUb7cyjEfaTBjpI9mq6hkDkoTSL2Su8s7o0SXfVPi6o8NfjyCGIbyDRszZWts4wBw83pUDS//zGnfaSv65BoZ9dXGdckRznpgxuHqTeBGx0P1vSLbP76f1OZ/O/tHxBmSG7KL4XyHc6BG7K4tayEI9e6qJoL0St9M7GxZ9g3qHm0kQfPekvcOXxQuVn8n9SG6/QipQKR4fG0dRp4GqoIXGUjjvbJot7A9kG0IrykPagAXznZnMBG",
        "src_file_sha256": "39baa167de334fef185ae8b97e8c709a307eed08e80fe115577c59a05200a13a",
        "src_file_path": "downloaded_files/mstsc/39baa167de334fef185ae8b97e8c709a307eed08e80fe115577c59a05200a13a",
        "src_file_company": "Alexander Roshal"
      }
    ]
  }
}