T1021.001Lateral Movement
Remote Desktop Protocol
Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports0
Detections
16 Sigma rules tagged T1021.001Remote Desktop ProtocolT1021.00116 general rules
- Hermetic Wiper TG Process Patternshightest
- Outbound RDP Connections Over Non-Standard Toolshightest
- Potential Tampering With RDP Related Registry Keys Via Reg.EXEhightest
- Publicly Accessible RDP Servicehightest
- RDP Login from Localhosthightest
- RDP Over Reverse SSH Tunnelhightest
- RDP over Reverse SSH Tunnel WFPhightest
- RDP to HTTP or HTTPS Target Portshightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Remote Desktop Protocol
1 CVE, by priority. Each link shows its badge.- CVE-2023-22952Multiple SugarCRM Products Remote Code Execution VulnerabilitySugarCRM · Multiple ProductsKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1078Valid Accounts+7 moreMITRE CTID mapping of the KEV entry · follow-on activity80.1%Top 0.38%69.1priority