tfMITRE ATT&CK sub-technique

Remote Desktop Protocol T1021.001

Tactic: Lateral Movement
Platform: Windows
Version: 1.4
Created: 11 February 2020
Last modified: 12 May 2026
Contributor: Matthew Demaske, Adaptforward

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 4%

Threat groups96th percentile · 96% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 4%

Campaigns96th percentile · 96% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 20%

Tools & malware80th percentile · 80% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 8%

Detection rules92nd percentile · 92% of ATT&CK techniques have this many detection rules written or fewer.

Remote Desktop Protocol MITRE reference T1021.001

Top 4%of all ATT&CK techniques for number of groups

37 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

VOID MANTICOREG1055 ↗

Has used RDP to move laterally within the victim environment.1

created 2026-04-201 referenceaka COBALT MYSTIQUE

MirrorFaceG1054 ↗

Has used RDP to exfiltrate files of interest.1

created 2026-04-171 referenceaka Earth Kasha

Medusa GroupG1051 ↗

Has used RDP to conduct lateral movement and exfiltrate data.1 Medusa Group has also utilized the Windows executable mstsc.exe for RDP activities through the command mstsc.exe /v:{hostname/ip}.1

created 2025-10-152 references

BlackByteG1043 ↗

Has used RDP to access other hosts within victim networks.1 2

created 2024-12-162 referencesaka Hecamede

INC RansomG1032 ↗

Has used RDP to move laterally.1 2 3 4

created 2024-06-064 referencesaka GOLD IONIC

AgriusG1030 ↗

Tunnels RDP traffic through deployed web shells to access victim environments via compromised accounts.1 Agrius used the Plink tool to tunnel RDP connections for remote access and lateral movement in victim environments.2

created 2024-05-212 referencesaka Pink Sandstorm

All 37 groups for this technique · 6 newest in this preview

Offense vs defense T1021.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 9Sigma rules (cumulative) · 16Splunk ESCU (cumulative) · 17

first rule: 2018 Q1 · 9 of 9 campaigns plotted

Remote Desktop Protocol detection strategy DET0327

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Multi-event Detection Strategy for RDP-Based Remote Logins and Post-Access Activity

Enterprise

1 platform

AN0931 · Windows

Remote Desktop (RDP) logon by a user followed by unusual process execution, file access, or lateral movement activity within a short timeframe.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Logon Session CreationDC0067	WinEventLog:Security	EventCode=4624, 4648
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22
Logon Session MetadataDC0088	WinEventLog:Security	EventCode=4778, EventCode=4779

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Temporal threshold to correlate login with post-login activity (e.g., 5 minutes)
UserContext	Tune for non-admin users or service accounts expected to use RDP
ProcessList	Define suspicious post-login processes such as cmd.exe, powershell.exe, certutil.exe
HostAccessPatterns	Scope detection to uncommon or first-time access between source and destination hosts

3 analytics

The Remote Desktop Protocol (RDP), built in to Microsoft operating systems, allows a user to remotely log in to the desktop of another host. It allows for interactive access of the running windows, and forwards key presses, mouse clicks, etc. Network administrators, power users, and end-users may use RDP for day-to-day operations. From an adversary's perspective, RDP provides a means to laterally move to a new host. Determining which RDP connections correspond to adversary activity can be a difficult problem in highly dynamic environments, but will be useful in identifying the scope of a compromise.

TypesSituational Awareness, TTPCoverageMediumSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-RTSD	Remote Terminal Session Detection

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
flow	end	dest_port
flow	start	dest_ip
flow	start	dest_port
flow	start	src_ip

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

flow_start = search Flow:Start
flow_end = search Flow:End
rdp_start = filter flow_start where (port == "3389")
rdp_end = filter flow_start where (port == "3389")
rdp = group flow_start, flow_end by src_ip, src_port, dest_ip, dest_port
output rdp

Monitoring logon and logoff events for hosts on the network is very important for situational awareness. This information can be used as an indicator of unusual activity as well as to corroborate activity seen elsewhere.

TypeSituational AwarenessCoverageModerateSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-ANET	Authentication Event Thresholding

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

This base pseudocode looks for user logon events and filters out the top 30 account names to reduce the occurrence of noisy service accounts and the like. It is meant as a starting point for situational awareness around such events.

logon_events = search User_Session:Login
filtered_logons = filter logon_events where (
  user NOT IN TOP30(user))
output filtered_logons

Splunk version of the above pseudocode. NOTE - this is liable to be quite noisy and will need tweaking, especially in terms of the number of top users filtered out.

index=__your_win_event_log_index__ EventCode=4624|search NOT [search index=__your_win_event_log_index__ EventCode=4624|top 30 Account_Name|table Account_Name]

DNIF version of the above pseudocode.

_fetch * from event where $LogName=WINDOWS-NXLOG-AUDIT AND $SubSystem=AUTHENTICATION AND $Action=LOGIN group count_unique $ScopeID, $User limit 30
>>_store in_disk david_test win_top_30 stack_replace
>>_fetch * from event where $LogName=WINDOWS-NXLOG-AUDIT AND $SubSystem=AUTHENTICATION AND $Action=LOGIN limit 10000
>>_checkif lookup david_test win_top_30 join $ScopeID = $ScopeID str_compare $User eq $User exclude

A remote desktop logon, through RDP, may be typical of a system administrator or IT support, but only from select workstations. Monitoring remote desktop logons and comparing to known/approved originating systems can detect lateral movement of an adversary.

TypeSituational AwarenessCoverageModerateSubmitted2016

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-RTSD	Remote Terminal Session Detection

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Look in the system logs for remote logons using RDP.

[EventCode] == 4624 and
[AuthenticationPackageName] == 'Negotiate' and
[Severity] == "Information" and
[LogonType] == 10

LogPoint version of the above pseudocode.

norm_id=WinServer event_id=4624 package="Negotiate" log_level="INFO" logon_type=10

Tests4ExecutorsPowerShell 2 · cmd 2Need elevation2 of 4Have prerequisites1Have cleanup4Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

RDP to DomainController

windows

PowerShell

—

Yes

Attempt an RDP session via Remote Desktop Application to a DomainController.

Input arguments

Name	Type	Default	Description
domain	string	$Env:USERDOMAIN	domain argument default %USERDOMAIN%
password	string	1password2!	Password
username	string	$ENV:USERNAME	Username argument default %username%
logonserver	string	$ENV:logonserver.TrimStart("\")	ComputerName argument default %logonserver%

Attack command

$Server=#{logonserver}
$User = Join-Path #{domain} #{username}
$Password="#{password}"
cmdkey /generic:TERMSRV/$Server /user:$User /pass:$Password
mstsc /v:$Server
echo "RDP connection established"

Cleanup command

$p=Tasklist /svc /fi "IMAGENAME eq mstsc.exe" /fo csv | convertfrom-csv
if(-not ([string]::IsNullOrEmpty($p.PID))) { Stop-Process -Id $p.PID }

Prerequisite

Computer must be domain joined

Check

if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain) { exit 0} else { exit 1}

Satisfy

Write-Host Joining this computer to a domain must be done manually

GUID9590bf43-0165-41cb-9ae1-77022c5907ce

Changing RDP Port to Non Standard Port via Powershell

windows

PowerShell

Required

—

Yes

Changing RDP Port to Non Standard Port via Powershell

Input arguments

Name	Type	Default	Description
NEW_Remote_Port	string	4489	New RDP Listening Port
OLD_Remote_Port	string	3389	Default RDP Listening Port

Attack command

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "PortNumber" -Value #{NEW_Remote_Port}
New-NetFirewallRule -DisplayName 'RDPPORTLatest-TCP-In' -Profile 'Public' -Direction Inbound -Action Allow -Protocol TCP -LocalPort #{NEW_Remote_Port}

Cleanup command

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "PortNumber" -Value #{OLD_Remote_Port}
Remove-NetFirewallRule -DisplayName "RDPPORTLatest-TCP-In" -ErrorAction Ignore 
Get-Service TermService | Restart-Service -Force -ErrorAction Ignore

GUID0a359402-a267-4a27-8bdc-7cc5e9ec6775

Changing RDP Port to Non Standard Port via Command_Prompt

windows

cmd

Required

—

Yes

Changing RDP Port to Non Standard Port via Command_Prompt

Input arguments

Name	Type	Default	Description
NEW_Remote_Port	string	4489	New RDP Listening Port
OLD_Remote_Port	string	3389	Default RDP Listening Port

Attack command

reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d #{NEW_Remote_Port} /f
netsh advfirewall firewall add rule name="RDPPORTLatest-TCP-In" dir=in action=allow protocol=TCP localport=#{NEW_Remote_Port}

Cleanup command

reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d #{OLD_Remote_Port} /f >nul 2>&1
netsh advfirewall firewall delete rule name="RDPPORTLatest-TCP-In" >nul 2>&1
net stop TermService /y >nul 2>&1
net start TermService >nul 2>&1

GUIDe5783cb1-a764-4c5e-ae0d-f85e47a7e7b6

Disable NLA for RDP via Command Prompt

windows

cmd

—

Yes

Disables network-level authentication (NLA) for RDP by changing a registry key via Command Prompt Disabling NLA for RDP can allow remote user interaction with the Windows sign-in screen prior to authentication. According to Microsoft, Flax Typhoon actors used this technique implementation to achieve persistence on victim systems: https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/ See also: https://github.com/EmpireProject/Empire/blob/master/lib/modules/powershell/management/enable_rdp.py

Input arguments

Name	Type	Default	Description
Default_UserAuthentication	string	1	Default UserAuthentication registry value

Attack command

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /d 0 /t REG_DWORD /f

Cleanup command

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /d #{Default_UserAuthentication} /t REG_DWORD -f >nul 2>&1

GUIDdfac2699-4b9f-4cba-92a5-84cf4afb772b

Tests from Atomic Red Team (MIT licence) · technique definition

Remote Desktop Protocol detections T1021.001

33 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 8%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs