Last updated
Last updated
Name: Remote Desktop Protocol
ID: T1021.001
Tactics:
Technique:
Remote Desktop Protocol (RDP) [T1021.001] is a sub-technique of the MITRE ATT&CK framework under the technique "Remote Services" (T1021). It involves adversaries leveraging Microsoft's Remote Desktop Protocol—a proprietary protocol designed to provide users with a graphical interface to remotely access and manage systems. Attackers exploit RDP to establish persistent remote access, move laterally within networks, or conduct malicious activities such as data exfiltration, privilege escalation, and sabotage. Due to the widespread use of RDP in enterprise environments, adversaries commonly target misconfigured or vulnerable RDP services to gain unauthorized access.
Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft, typically running on TCP port 3389. It is widely used by system administrators and IT professionals to remotely manage Windows desktops and servers. Attackers exploit RDP through multiple execution methods and mechanisms, including:
Brute Force Attacks:
Attackers attempt to guess weak credentials using automated tools like Hydra, Medusa, or custom scripts.
Credential stuffing attacks using leaked credentials from data breaches.
Credential Theft and Reuse:
Using credentials obtained from phishing, keylogging malware, or credential-dumping tools such as Mimikatz.
Reusing credentials stolen from other compromised systems within the network.
Exploitation of Vulnerabilities:
Exploiting known vulnerabilities in RDP implementations, such as BlueKeep (CVE-2019-0708), DejaBlue (CVE-2019-1181, CVE-2019-1182), or other RDP-related vulnerabilities.
Utilizing exploits available in public exploit frameworks (Metasploit, Cobalt Strike).
Tunneling and Proxying:
Attackers may tunnel RDP connections through SSH or VPN services to evade detection.
Establishing RDP sessions through compromised internal hosts acting as pivots.
Persistence and Lateral Movement:
Once initial access is gained, adversaries use RDP sessions to move laterally through the network, accessing additional systems and resources.
Attackers may modify RDP settings, create additional user accounts, or alter security configurations to maintain persistent remote access.
Attackers commonly leverage RDP throughout various stages of the cyber kill chain, including:
Initial Access:
Exploiting exposed and misconfigured RDP endpoints accessible directly from the internet.
Brute-forcing weak or default credentials on externally facing RDP services.
Execution and Persistence:
Using RDP to execute commands, install malware, deploy ransomware, or modify system configurations.
Establishing persistent connections through scheduled tasks, registry modifications, or creating hidden administrative accounts.
Privilege Escalation and Credential Access:
Utilizing RDP sessions to access sensitive tools and resources, facilitating privilege escalation.
Using compromised credentials to access privileged accounts and sensitive data.
Lateral Movement:
Pivoting from one compromised host to another within internal networks using RDP sessions.
Accessing critical infrastructure, sensitive databases, and backup systems through RDP.
Exfiltration and Impact:
Leveraging RDP to facilitate data exfiltration by transferring files directly through remote desktop sessions.
Deploying ransomware or destructive malware via RDP connections to maximize impact.
Effective detection of malicious RDP activity involves multiple layers of monitoring and analysis, including:
Network Monitoring and Analysis:
Monitoring for anomalous RDP traffic (TCP port 3389) originating from unusual sources or at unusual times.
Detecting multiple failed login attempts indicative of brute-force attacks through network security appliances or IDS/IPS systems.
Log Analysis and Alerting:
Reviewing Windows Security Event Logs (Event IDs 4624, 4625, 4778, 4779, 1149) for suspicious login activity.
Identifying logins from unexpected or foreign IP addresses, unusual user accounts, or abnormal login times.
Endpoint Detection and Response (EDR):
Leveraging EDR solutions to detect suspicious processes or anomalous behaviors associated with RDP sessions.
Monitoring for unusual file transfers or execution of unauthorized commands through RDP sessions.
Behavioral Analytics and SIEM Integration:
Utilizing SIEM tools to correlate RDP-related activities across multiple endpoints and network devices.
Implementing behavioral analytics to detect deviations from established baselines of normal RDP usage.
Indicators of Compromise (IoCs):
Unusual or unknown user accounts created for RDP access.
Increased RDP connection attempts from suspicious IP addresses or known malicious hosts.
Presence of RDP brute-force tools or credential-dumping utilities on endpoints.
Early detection of malicious RDP usage is critical due to the potential severe impacts on organizations, including:
Unauthorized Access and Privilege Escalation:
Attackers gaining control of sensitive systems, leading to unauthorized access to confidential data and privileged accounts.
Data Exfiltration and Theft:
Malicious actors using RDP sessions to exfiltrate sensitive corporate information, intellectual property, or personally identifiable information (PII).
Ransomware and Destructive Attacks:
RDP is frequently exploited by ransomware operators to deploy destructive payloads, encrypt critical data, and disrupt business operations.
Operational Disruption and Business Impact:
Unauthorized RDP access can severely impact business continuity, leading to downtime, financial losses, and reputational damage.
Regulatory and Compliance Risks:
Failure to detect and mitigate unauthorized RDP access can result in compliance violations, regulatory penalties, and legal liabilities.
Several notable real-world examples demonstrate adversaries exploiting RDP to compromise organizations:
SamSam Ransomware Attacks:
Attackers leveraged exposed RDP endpoints and brute-forced weak credentials to gain initial access.
After compromising systems, adversaries deployed SamSam ransomware, encrypting critical files and demanding ransom payments, resulting in significant operational disruptions.
BlueKeep Vulnerability Exploitation (CVE-2019-0708):
Attackers exploited the BlueKeep vulnerability, a critical RDP flaw allowing remote code execution without authentication.
Security researchers demonstrated proof-of-concept exploits, and threat actors actively scanned the internet to identify vulnerable systems.
Dharma/Crysis Ransomware Campaigns:
Attackers utilized brute-force RDP attacks to gain unauthorized access to Windows servers.
After successful compromise, attackers deployed Dharma ransomware variants, encrypting files and demanding ransom payments.
APT41 (Winnti Group) Operations:
APT41, a sophisticated threat actor, leveraged compromised RDP credentials to gain persistent access and perform lateral movement within targeted networks.
The group utilized RDP sessions to deploy backdoors, exfiltrate sensitive data, and maintain long-term persistence.
These examples illustrate the versatility of RDP as a common vector for threat actors, emphasizing the importance of securing, monitoring, and promptly detecting malicious RDP activities.
Remote Desktop Protocol [T1021.001]