tsclient share execution

A program was executed directly from \\tsclient\ — the virtual share that maps the drives of the machine on the OTHER end of an RDP session.

This is file transfer that never looks like file transfer. The binary lives on the connecting client, runs on the server, and crosses the boundary inside the RDP channel, so no download, no SMB write, and no proxy record exists. It is how an operator with RDP access brings tooling onto a jump host, and how a compromised client seeds the server it connects to.

• T1021.001Remote Services: Remote Desktop Protocol· Lateral Movement

Some administrators genuinely run tools from their own drive over RDP rather than copying them first, so in a small team this can be routine — establish once whether drive redirection is even permitted by policy. If it is not, any hit is a policy violation regardless of the file.

To confirm: the path names the client's drive letter, so \\tsclient\c\... is the connecting machine's C:. Identify who held that session and recover the binary from the client, not the server — the server may only ever have held it in memory.

Declarative YAML read by the detection engine — data, never executed. Confidence 80%. Source: rules/windows/tsclient_share_execution.yaml, licensed under the Apache License 2.0.

id: windows.lateral_movement.tsclient_share_execution
version: 1.0.0
status: stable
severity: high
confidence: 0.8
platforms: [windows]
mitre_techniques: [T1021.001]
description: |
  A program was executed directly from `\\tsclient\` — the virtual share that maps
  the drives of the machine on the OTHER end of an RDP session.

  This is file transfer that never looks like file transfer. The binary lives on the
  connecting client, runs on the server, and crosses the boundary inside the RDP
  channel, so no download, no SMB write, and no proxy record exists. It is how an
  operator with RDP access brings tooling onto a jump host, and how a compromised
  client seeds the server it connects to.
match:
  command_line_contains_any:
    - '\\tsclient\'
correlation_keys: [hostname, user_name]
false_positive_guidance: |
  Some administrators genuinely run tools from their own drive over RDP rather than
  copying them first, so in a small team this can be routine — establish once
  whether drive redirection is even permitted by policy. If it is not, any hit is a
  policy violation regardless of the file.

  To confirm: the path names the client's drive letter, so `\\tsclient\c\...` is the
  connecting machine's `C:`. Identify who held that session and recover the binary
  from the client, not the server — the server may only ever have held it in memory.

• Remote access enabledSeverity high
• RDP remote loginSeverity medium
• RDP logon from loopbackSeverity critical
• LSASS named pipe accessSeverity high
• NTLM network logonSeverity medium
• Suspicious named pipeSeverity high