T1021.001 Remote Services: Remote Desktop Protocol

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). MITRE ATT&CK

2 programs on CmdID 8 Sigma rules T1021.001 on attack.mitre.org

Part of

MITRE ATT&CK

T1021Remote Services

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

highHermetic Wiper TG Process PatternsFlorian Roth (Nextron Systems) · Windows

highPotential Tampering With RDP Related Registry Keys Via Reg.EXEpH-T (Nextron Systems), @Kostastsale, TheDFIRReport · Windows

highSuspicious Plink Port ForwardingFlorian Roth (Nextron Systems) · Windows

highSuspicious RDP Redirect Using TSCONFlorian Roth (Nextron Systems) · Windows

highUser Added to Remote Desktop Users GroupFlorian Roth (Nextron Systems) · Windows

mediumPort Forwarding Activity Via SSH.EXENasreddine Bencherchali (Nextron Systems) · Windows

mediumRDP Enable or Disable via Win32_TerminalServiceSetting WMI ClassDaniel Koifman (KoifSec), Swachchhanda Shrawan Poudel (Nextron Systems) · Windows