mstsc.exe (Microsoft Remote Desktop Connection)

mstsc.exe is the built-in Microsoft Remote Desktop Connection (RDC) client that ships with all supported Windows versions. The "MSTSC" name is a historical acronym for "Microsoft Terminal Services Client" — the product was renamed from Terminal Services to Remote Desktop Services, but the binary kept the original name. It is signed by Microsoft and located in %SystemRoot%\System32\mstsc.exe. Adversaries abuse the native RDP client for interactive lateral movement (T1021.001) and as a living-off-the-land remote-access pathway because it is present, signed, and frequently allow-listed in enterprise environments. This entry consolidates the previous duplicate entries "Microsoft RDP" and "Microsoft TSC", which described the same binary under different names. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only.