mstsc.exe

mstsc.exe connects to a remote computer over the Remote Desktop Protocol (RDP). It takes a target with /v:<host>, can open a saved .rdp connection file, and supports options for gateways, restricted-admin mode, and session shadowing. The genuine binary lives at C:\Windows\System32\mstsc.exe. It records connection history per user, which is a useful artifact when reconstructing movement.

Legitimately, mstsc is run by administrators and remote workers to reach servers and desktops. Where it connects, under whose account, and from what parent are what give an instance meaning.

mstsc.exe is the everyday tool for RDP lateral movement (T1021.001). After stealing credentials, an attacker uses Remote Desktop to log in to other machines interactively, blending with normal administration. The patterns that stand out are RDP fanning out to many hosts quickly, RDP initiated from a server or service context that has no reason to, and connections driven by a script rather than a person.

mstsc is also an artifact source. Its per-user connection history and the corresponding logon events on the targets help reconstruct an operator's path through the network. Because the tool itself is legitimate, the destinations, the account, and the origin are what distinguish administration from intrusion.