mstsc.exe
Sources: 300M+ executions observed in the wild.
Summary
Microsoft Terminal Services Client (Remote Desktop Connection) - connects to remote Windows systems via RDP.
mstsc.exe is the 476th most commonly executed Windows program in EchoTrail's dataset, observed 12,810 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by explorer.exe.
Get this in your tools
The same record for mstsc.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/mstsc.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\System3299.86%
- C:\Windows\SysWOW640.14%
Top Hashes (SHA256)
- 52cce055270fe95777665ccece8309aa41ec3d452eef4b32f78d313855c8db7921.79%
- cf7882e388852eb0d62c4b5b40832947d18dafca4d2503bb30c4c8ae53a656479.38%
- e102e84e9b710d8a9e8c62ce6218a6b39fc1f6e41bdc3f2ca881d4ecb70bc1947.43%
- d4967b245ce624c9d15e1563c82c84971ed4085aa9b2dc05b40c7e7f4be1caa36.6%
- 5ba2b2b52da79fc124c39e1e345bc83338dd2c83834cb663f1f9c217472358025.7%
- 355ca834be29c148d27f973299fac1c434bcec5b7b319a47c7d98eb1c96da1eb5.24%
- c6e4edc0577fa43e5bf073b9304d12e66b89998d5df086d4e99657c65923e1664.74%
- 0b458c567a96f54ad0025807265d77e3cd407b6ebb87b9a5c87b560235b4dc814.31%
- 3e65a448cef91757ae5b1447ca774f936e325db77989783bd976b7a03c0186d53.38%
- 9280b4fb09595491d8eee9ba451ef0fcfc467f5751cd00b7db9bd636360734723.16%
Process Ancestry
Top Grandparents
- userinit.exe77.79%
- svchost.exe14.06%
- services.exe3.25%
- explorer.exe2.41%
- winlogon.exe0.95%
- WerFault.exe0.52%
- iexplore.exe0.32%
- OUTLOOK.EXE0.18%
- OneDrive.exe0.12%
- taskhostw.exe0.12%
Top Parents
- explorer.exe87.04%
- RuntimeBroker.exe7.92%
- svchost.exe2.41%
- chrome.exe1.01%
- cmd.exe0.28%
- mstsc.exe0.14%
- iexplore.exe0.09%
- OUTLOOK.EXE0.06%
- OpenWith.exe0.05%
Top Children
- rundll32.exe99.17%
- WerFault.exe0.39%
- E_YARNRAE.EXE0.25%
- mstsc.exe0.16%
- acrotray.exe0.01%
- CPC10Q.EXE0.01%
Security Analysis
What does mstsc.exe normally do?
Used by administrators and users to connect to remote Windows systems. Opens RDP connections on port 3389.
When is mstsc.exe suspicious?
Execution on servers that do not typically originate RDP connections. Scripted execution with saved credentials. Connecting to unusual internal or external destinations.
How do attackers abuse mstsc.exe?
Attackers use RDP for lateral movement after obtaining credentials. mstsc.exe may be launched with /v: parameter to automate connections. RDP session hijacking via tscon.exe is a related technique.
Detection guidance
Correlate mstsc.exe execution with network connections to identify destinations. Alert on RDP originating from unusual hosts or service accounts.
False positive notes
IT administrators and helpdesk staff regularly use mstsc.exe. Jump server usage is normal.
MITRE ATT&CK techniques
Related Processes
Ask Rocky about mstsc.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for mstsc.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.