Threat intelligence / Technique

Remote Desktop Protocol

Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services) Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the [Accessibility Features](https://attack.mitre.org/techniques/T1546/008) or [Terminal Services DLL](https://attack.mitre.org/techniques/T1505/005) for Persistence.(Citation: Alperovitch Malware)

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services) Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the [Accessibility Features](https://attack.mitre.org/techniques/T1546/008) or [Terminal Services DLL](https://attack.mitre.org/techniques/T1505/005) for Persistence.(Citation: Alperovitch Malware)

73 recorded

Relationships

mitigates

from Audit

Mitigation

mitigates

from Disable or Remove Feature or Program

Mitigation

mitigates

from Limit Access to Resource Over Network

Mitigation

mitigates

from Multi-factor Authentication

Mitigation

mitigates

from Network Segmentation

Mitigation

mitigates

from Operating System Configuration

Mitigation

mitigates

from Privileged Account Management

Mitigation

mitigates

from User Account Management

Mitigation

revoked-by

from Remote Desktop Protocol

Technique

subtechnique-of

to Remote Services

Technique

uses

from 2025 Poland Wiper Attacks

Campaign

uses

Group

uses

from Akira

Group

uses

from APT1

Group

uses

from APT28 Nearest Neighbor Campaign

Campaign

uses

from APT3

Group

uses

from APT39

Group

uses

from APT41

Group

uses

from APT5

Group

uses

from Aquatic Panda

Group

uses

from Axiom

Group

uses

Group

uses

from Blue Mockingbird

Group

uses

from C0015

Campaign

uses

from C0018

Campaign

uses

from C0032

Campaign

uses

Malware

uses

Group

uses

from Cobalt Group

Group

uses

from Cobalt Strike

Malware

uses

from Cutting Edge

Campaign

uses

Malware

uses

Group

uses

from FIN10

Group

uses

from FIN13

Group

uses

from FIN6

Group

uses

from FIN7

Group

uses

from FIN8

Group

uses

from Fox Kitten

Group

uses

Group

uses

from HomeLand Justice

Campaign

uses

from Imminent Monitor

Tool

uses

from INC Ransom

Group

uses

from Indrik Spider

Group

uses

from jRAT

Malware

uses

Group

uses

Tool

uses

from Lazarus Group

Group

uses

Group

uses

from Magic Hound

Group

uses

from Medusa Group

Group

uses

Group

uses

from MirrorFace

Group

uses

from njRAT

Malware

uses

Group

uses

from Operation Digital Eye

Campaign

uses

Group

uses

from Pupy

Tool

uses

from Pysa

Malware

uses

Tool

uses

Malware

uses

from Revenge RAT

Malware

uses

from Scattered Spider

Group

uses

Malware

uses

from ServHelper

Malware

uses

Group

uses

from SolarWinds Compromise

Campaign

uses

from VOID MANTICORE

Group

uses

from Volt Typhoon

Group

uses

from WarzoneRAT

Malware

uses

from Wizard Spider

Group

uses

Malware

uses

Malware

3 external

References

mitre-attack

T1021.001

Alperovitch Malware

https://web.archive.org/web/20191115195333/https://www.crowdstrike.com/blog/adversary-tricks-crowdstrike-treats/

TechNet Remote Desktop Services

https://technet.microsoft.com/en-us/windowsserver/ee236407.aspx