Potential MSTSC Shadowing Activity

MSTSC shadowing is an attractive technique because it allows attackers to interact with an already authenticated user session without needing to steal credentials or create a new login event.

Once an attacker has gained sufficient privileges on a Windows system (typically local administrator or equivalent rights), they can enumerate active user sessions on that machine. Using the built-in mstsc.exe tool with the ‘/shadow:<sessionID>’ parameter, the attacker can attach to a logged-in user’s session. By adding ‘/noconsentprompt’, they can bypass the normal requirement for the user to approve the session sharing request, effectively allowing silent access to the user’s desktop.

Instead of triggering suspicious activity like new logons or remote connections, the attacker is effectively piggybacking on an existing trusted session. They inherit the user’s context, permissions, and access to resources such as mapped drives, internal applications, or authenticated web sessions. This allows them to perform actions that appear as if they were executed by the legitimate user, making detection more difficult.

Attackers use this technique for several reasons:

• Stealth and evasion: Since no new login is required, traditional detections based on authentication events may not trigger. The activity blends in with legitimate user behavior.
• Privilege leverage: If the targeted session belongs to a more privileged user (e.g., an administrator), the attacker can immediately operate with elevated access.
• Interactive control: Unlike many post-exploitation techniques, shadowing provides full graphical access to the user’s desktop, enabling actions that would be harder via command-line only access.
• Data access and exfiltration: The attacker can directly view sensitive data, open documents, or interact with internal tools accessible only within that user’s session.
• Lateral movement: From the shadowed session, the attacker may access additional systems or credentials, expanding their foothold in the environment.

Overall, MSTSC shadowing is valuable because it leverages legitimate administrative functionality in a way that reduces noise, increases operational flexibility, and makes attribution to malicious activity more challenging.

RDP Login from Localhost

This technique involves making an RDP connection appear as if it originated from the local machine, even though the attacker is remote. This is typically achieved by tunneling RDP traffic through an already established foothold or proxy on the target system.

An attacker first compromises a host inside the network (or gains access to a jump box). Once they have a foothold, they set up a local port forwarding or tunneling mechanism (for example, via SSH, SOCKS proxies, or post-exploitation frameworks). This tunnel binds a local port on the compromised system to the RDP service, so when the attacker connects, the traffic is forwarded internally rather than coming directly from an external IP.

Because of this setup, when the RDP session is established, the destination host logs the connection as coming from ‘127.0.0.1’ or ‘::1’, which are loopback addresses. From the system’s perspective, it looks like the user initiated the RDP session locally, even though the attacker is controlling it remotely through the tunnel.

Attackers use this technique primarily for evasion and stealth. By hiding behind localhost, they bypass many security controls that rely on network-based detection, such as IP-based access control lists, geolocation monitoring, or anomaly detection tied to external addresses. It also makes investigations harder because the logs no longer reveal the attacker’s true origin, obscuring attribution and lateral movement paths.

Additionally, this method is useful for bypassing network segmentation or firewall restrictions. If direct RDP access between two systems is blocked, an attacker can pivot through an intermediate machine and tunnel the connection, effectively reaching systems that would otherwise be inaccessible.

Overall, this approach helps attackers blend in with legitimate activity, avoid detection mechanisms, and move laterally within a network while masking their true entry point.