RDP Attack Tool Activity

Block inbound and outbound traffic from suspicious hosts at the network perimeter

Quarantine the device while checking for indicators of compromise, such as the presence of malware

Limit the number of RDP login attempts, and then lock user accounts that exceed this number

Review access controls to ensure that only authorized users can connect to remote access services with RDP

Review authentication methods and enforce policies for secure credential creation, strong authentication methods for remote access services, and multi-factor authentication

Implement microsegmentation by adding secure zones based on the zero-trust security model: partition network traffic with endpoint firewalls, virtual or software-defined networks, or physical networks

• T1110
• T1021.001