TA0008 · LATERAL MOVEMENT
Remote Desktop Protocol
Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Detect it with
Use of RDP may be legitimate, depending on the network environment and how it is used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior with RDP.
Why it matters on shift
Remote Desktop Protocol is one of the concrete ways adversaries achieve lateral movement. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After lateral movement, the next tactic is usually Collection. Search your telemetry for the transition before closing the ticket.
Kill-chain context