Remote Desktop Protocol (RDP) Lateral Movement

Overview

Remote Desktop Protocol (RDP) Lateral Movement is a technique used by adversaries to move within a compromised network by leveraging RDP sessions to access and control remote systems. This method facilitates the expansion of an attacker’s foothold beyond the initial access point, enabling further exploitation, reconnaissance, and data collection across the environment.

Attack Objective

• Gain remote access and control over additional systems within a network
• Supports lateral movement, privilege escalation, persistence, and execution stages of the attack lifecycle
• Advances the attacker’s position by enabling access to higher-value targets and expanding control over network resources

How the Technique Works

Adversaries utilize legitimate RDP functionality to connect from one compromised host to another, often using stolen credentials or session hijacking. This allows them to execute commands, deploy tools, and access sensitive data remotely. The technique exploits the trust relationships and network connectivity between systems to propagate access without triggering immediate suspicion.

Common Methods & Variations

• Use of valid user credentials obtained via credential dumping, phishing, or brute force
• Session hijacking or token theft to impersonate legitimate users
• On-premises environments leveraging native Windows RDP services
• Cloud or hybrid environments where RDP gateways or virtual desktops are accessible
• Living-off-the-land approaches using built-in Windows tools and protocols versus deployment of custom remote access tools

Indicators of Compromise (IOCs)

• Unusual or unauthorized RDP logins, especially from unexpected source IPs or at odd hours
• Multiple failed RDP authentication attempts followed by successful connections
• Creation of new user accounts or changes in group memberships related to remote access
• Network traffic patterns consistent with RDP sessions between internal hosts
• Event logs showing remote desktop session initiation and termination

Detection Strategies

• Monitoring Windows Event Logs (e.g., Event ID 4624 for logon, Event ID 4778 for session reconnection)
• Network traffic analysis for RDP protocol usage and anomalies
• Behavioral detection focusing on unusual login times, source IP addresses, and lateral movement patterns
• Correlation of authentication logs with endpoint telemetry to identify suspicious access

Mitigation & Prevention

• Enforce strong authentication mechanisms such as multi-factor authentication (MFA) for RDP access
• Restrict RDP access through network segmentation, firewalls, and VPNs
• Implement least privilege principles and regularly review user access rights
• Disable RDP where not required and limit the number of systems accessible via RDP
• Use account lockout policies and monitor for brute force attempts

Response Considerations

• Immediately isolate affected systems to prevent further lateral movement
• Investigate authentication logs and network traffic to identify compromised credentials and scope of access
• Reset or disable compromised accounts and enforce credential changes
• Conduct a thorough review of system and network configurations to identify and remediate vulnerabilities
• Enhance monitoring and harden RDP access controls post-incident

Related Techniques

• Credential Dumping for obtaining RDP credentials
• Pass-the-Hash and Pass-the-Ticket for authentication token reuse
• Windows Admin Shares for lateral movement
• Remote Services exploitation beyond RDP, such as SMB or SSH

Mapping & References

• MITRE ATT&CK Tactic: Lateral Movement
• MITRE ATT&CK Technique: T1021.001 – Remote Desktop Protocol
• Public advisories on RDP security best practices and incident reports involving RDP abuse