qwinsta is a tool tracked across 0 threat clusters and 1 intelligence report mention on ThreatCluster. First observed November 11, 2025; most recent activity November 11, 2025.
qwinsta (Query Session) is a Windows command-line utility that lists active and disconnected user sessions on a local or remote host. In cybersecurity, it functions as both a legitimate administration tool and a potential attacker technique for session enumeration; defenders can use it to detect anomalous logons and validate session state, while attackers may leverage it for lateral movement or credential access targeting.