Remote Desktop Protocol (T1021.001) is a lateral movement sub-technique for Windows. Adversaries use valid accounts to log in to a computer over the Remote Desktop Protocol and then act as the logged-on user.
Remote desktop is a common feature. It lets a user log in to an interactive session with the graphical desktop of a remote system. Microsoft's implementation is Remote Desktop Services, or RDS.
How attackers use it
MITRE says adversaries may connect over RDP or RDS to expand access, provided the service is enabled and allows accounts whose credentials they know. They will likely use credential access techniques to get those credentials first. This is why the sub-techniques for credential dumping and RDP show up together in real intrusions.
MITRE also notes that adversaries may combine RDP with Accessibility Features or with a Terminal Services DLL for persistence. In both cases the remote desktop logon is the way back in, so a change to those components deserves a look, not only the logon itself.
An RDP session looks like a legitimate user doing legitimate work. The tell is that it should not be this user, from this source, at this time.
How to detect it
MITRE's strategy is multi-event: an RDP logon by a user followed by unusual process execution, file access or lateral movement in a short time.
Data to collect:
- Windows Security log logon events (4624) with logon type 10 for remote interactive sessions, and 4625 for failures.
- The RemoteConnectionManager operational log, where event 1149 records network authentication success for a remote connection.
- Process creation events on the target after the logon, with command lines.
- Network flow logs for RDP connections between workstations. Workstation to workstation RDP is rarely needed and is a strong lateral movement signal.
- Logs from RDP gateways, if you use them, since they show who connected to what.
Useful alerts, from simple to rich:
- RDP logon from an internet address, which should never happen if you follow the mitigations below.
- An account logging on to a host it has never used before.
- A burst of failed logons followed by a success.
- An RDP session followed by credential access or discovery commands, or by connections to other hosts.
How to reduce the risk
MITRE lists these mitigations:
- Audit: review the Remote Desktop Users group regularly. Remove unnecessary accounts and groups.
- Limit Access to Resource Over Network: use remote desktop gateways.
- Network Segmentation: do not leave RDP reachable from the internet. Use firewall rules to block RDP between network security zones.
- Operating System Configuration: use group policy to set shorter session timeouts and a maximum time any one session can be active, and a maximum time a disconnected session stays active on the session host.
- Disable or Remove Feature or Program: disable the RDP service if it is not needed.
The cheapest change is the last one. Most workstations do not need to accept inbound RDP at all.
Closing the doors in order
If you are starting from scratch, a sensible order for RDP is:
- Remove direct internet exposure. This is the most important change. Check firewall rules and external scans for your own ranges, and cut anything that exposes the port.
- Put the service behind a gateway, so one place handles authentication and logging.
- Require multi-factor authentication at the gateway.
- Block RDP between workstations, and between network zones except where needed.
- Shrink the Remote Desktop Users group on every host, and review it.
- Set session time limits through group policy, as MITRE suggests.
Each step cuts the number of paths, and each leaves you with a simpler log to read.
Account hygiene
RDP uses ordinary accounts, so account habits decide how much damage a stolen credential does. Separate administrative accounts from daily accounts. Avoid using a domain administrator account to log on to workstations, since that leaves credentials where they can be taken. This is the same concern as in the credential dumping guides in this series: the less your privileged accounts touch, the less there is to steal.
Persistence points MITRE mentions
MITRE links RDP to two persistence methods: Accessibility Features and a Terminal Services DLL. Both change something that runs in connection with the logon screen or the remote desktop service. Watch for changes to those components, such as replacement of the accessibility programs that run at the sign-in screen, or a new service DLL registered for terminal services. A change there outside patching is a finding.
Tuning
Expect noise from administrators and help desk staff who use RDP daily. Allow their jump hosts and accounts, and then alert on everything else. Add context to each alert, including the source address, the logon time and what the account did in its first ten minutes on the host. Those ten minutes usually tell you whether it was a repair or a recon.
Cleanup after a suspected misuse
- Disconnect and log off the session, and block the source.
- Reset the credentials of the account used, and of any account that was logged on to the target.
- Review the target for the persistence points above.
- Look at where the account connected next.
Check your own environment
Check whether RDP is enabled on a Windows host (read-only, reg.exe):
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections
A value of 0 means remote desktop connections are allowed. A value of 1 means they are denied.
List who may connect (read-only, net.exe):
net localgroup "Remote Desktop Users"
Check whether the RDP port is listening (read-only, PowerShell):
Get-NetTCPConnection -LocalPort 3389 -State Listen
Then work through these questions:
- Which machines have RDP enabled that do not need it?
- Is any RDP port reachable from the internet? Check with your firewall rules and an external review of your own address ranges.
- Does every account in Remote Desktop Users still need access?
- Do RDP logons require multi-factor authentication through a gateway?
- Are session time limits set by policy?
Quick check
Which logon type represents a remote interactive session in the Windows Security log?
Logon type 10, recorded in event 4624, indicates a remote interactive logon such as RDP.
Why is workstation to workstation RDP a useful signal?
Few workstations need to accept RDP from each other. If one does, it usually points to lateral movement using a stolen credential.
What is the cheapest mitigation MITRE lists?
Disable the RDP service where it is not needed. A disabled service gives an adversary nothing to log in to.
