t1021-001-remote-desktop-protocol

name	T1021.001_remote-desktop-protocol
description	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP).
category	authorization
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1021.001","lateral-movement","windows","sub-technique"]
technique_id	T1021.001
tactic	lateral-movement
all_tactics	["lateral-movement"]
platforms	["Windows"]
mitre_url	https://attack.mitre.org/techniques/T1021/001
tech_stack	["windows"]
cwe_ids	["CWE-284"]
chains_with	["T1021","T1021.002","T1021.003","T1021.004","T1021.005","T1021.006","T1021.007","T1021.008"]
prerequisites	["T1021"]
severity_boost	{"T1021":"Chain with T1021 for deeper attack path","T1021.002":"Chain with T1021.002 for deeper attack path","T1021.003":"Chain with T1021.003 for deeper attack path"}

T1021.001 Remote Desktop Protocol

Sub-technique of: T1021

High-Level Description

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).

Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the Accessibility Features or Terminal Services DLL for Persistence.

Kill Chain Phase

• Lateral Movement (TA0008)

Platforms: Windows

What to Check

• Identify if Remote Desktop Protocol technique is applicable to target environment
• Check Windows systems for indicators of Remote Desktop Protocol
• Verify mitigations are bypassed or absent (8 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: RDP to DomainController

Attempt an RDP session via Remote Desktop Application to a DomainController.

Supported Platforms: windows

$Server=#{logonserver}
$User = Join-Path #{domain} #{username}
$Password="#{password}"
cmdkey /generic:TERMSRV/$Server /user:$User /pass:$Password
mstsc /v:$Server
echo "RDP connection established"

Dependencies:

• Computer must be domain joined

Atomic Test 2: Changing RDP Port to Non Standard Port via Powershell

Changing RDP Port to Non Standard Port via Powershell

Supported Platforms: windows Elevation Required: Yes

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "PortNumber" -Value #{NEW_Remote_Port}
New-NetFirewallRule -DisplayName 'RDPPORTLatest-TCP-In' -Profile 'Public' -Direction Inbound -Action Allow -Protocol TCP -LocalPort #{NEW_Remote_Port}