Wiki › Techniques, Tactics & Procedures (TTPs) › Initial Access › Remote Desktop Protocol (RDP) Abuse

Remote Desktop Protocol (RDP) Abuse

3 min read

Jump to:

Overview

Remote Desktop Protocol (RDP) abuse is a technique where adversaries exploit legitimate RDP services to gain unauthorized access to systems. It is commonly used across multiple stages of the attack lifecycle, enabling attackers to establish persistence, move laterally, and execute commands remotely. Due to its widespread deployment in enterprise environments, RDP abuse remains a favored method for adversaries seeking stealthy and direct control over compromised hosts.

Attack Objective

Gain unauthorized access and control over target systems
Supports Initial Access, Execution, Persistence, Privilege Escalation, Lateral Movement, and Command & Control stages
Advances attacker position by enabling remote interaction with compromised assets, facilitating further exploitation and data exfiltration

How the Technique Works

Adversaries leverage RDP, a protocol designed for remote graphical desktop access, to connect to target machines using stolen credentials, brute force attempts, or exploiting misconfigurations. Once connected, attackers can execute commands, deploy tools, and manipulate the system as if physically present. This access allows them to maintain persistence, escalate privileges, and move laterally within a network while blending in with legitimate administrative activity.

Common Methods & Variations

Credential theft and reuse for RDP login
Brute force or password spraying against exposed RDP endpoints
Exploitation of weak or default RDP configurations, including open ports and lack of network-level authentication
Use of on-premises RDP services or cloud-hosted virtual desktops
Living-off-the-land by using native RDP clients and protocols versus deploying custom remote access tools

Indicators of Compromise (IOCs)

Unusual RDP login events, including logins at odd hours or from unexpected IP addresses
Multiple failed RDP authentication attempts indicating brute force activity
Creation of new user accounts or changes in RDP-related group policies
Network traffic on TCP port 3389 or other configured RDP ports from suspicious sources
Execution of commands or processes following RDP sessions not associated with legitimate administrative activity

Detection Strategies

Monitoring Windows Event Logs for RDP logon events (e.g., Event ID 4624) and failed logon attempts (e.g., Event ID 4625)
Network traffic analysis focusing on RDP port usage and unusual connection patterns
Behavioral detection of anomalous session durations, concurrent sessions, or atypical user activity during RDP sessions
Correlation of identity and endpoint telemetry to identify suspicious credential use or lateral movement attempts

Mitigation & Prevention

Enforce strong authentication mechanisms such as multi-factor authentication (MFA) for RDP access
Restrict RDP access through network segmentation, firewalls, and VPNs to limit exposure
Disable or limit RDP services where not required and regularly audit RDP configurations
Implement account lockout policies and monitor for brute force attempts
Use endpoint protection solutions to detect and block unauthorized remote access tools

Response Considerations

Immediately isolate affected systems to prevent further unauthorized access
Investigate RDP session logs, authentication records, and network traffic to determine scope and entry points
Reset compromised credentials and review account permissions
Apply security patches and harden RDP configurations post-incident
Conduct a thorough review of lateral movement and persistence mechanisms established via RDP abuse

Related Techniques

Credential Access techniques such as credential dumping and password spraying
Lateral Movement techniques including Pass-the-Hash and Windows Admin Shares
Persistence mechanisms like creating new user accounts or modifying startup scripts
Defense Evasion tactics involving disabling security tools or clearing logs post-RDP session

Mapping & References

MITRE ATT&CK: T1076 – Remote Desktop Protocol
MITRE ATT&CK: T1021.001 – Remote Services: Remote Desktop Protocol
Public advisories on RDP brute force and exploitation incidents from cybersecurity organizations
Research articles detailing detection and mitigation strategies for RDP abuse

Tags: Attack Techniques Command and Control Cybersecurity Defense Evasion Execution Initial Access lateral movement persistence privilege escalation RDP remote desktop protocol