Potential MSTSC Shadowing Activity (6ba5a05f-b095-4f0a-8654-b825f4f16334)

Detects RDP session hijacking by using MSTSC shadowing

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Potential MSTSC Shadowing Activity (6ba5a05f-b095-4f0a-8654-b825f4f16334)	Sigma-Rules	RDP Hijacking - T1563.002 (e0033c16-a07e-48aa-8204-7c3ca669998c)	Attack Pattern	1
RDP Hijacking - T1563.002 (e0033c16-a07e-48aa-8204-7c3ca669998c)	Attack Pattern	Remote Service Session Hijacking - T1563 (5b0ad6f8-6a16-4966-a4ef-d09ea6e2a9f5)	Attack Pattern	2