Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
The Remote Desktop Protocol (RDP) is a common target for attackers because RDP provides remote access to a Windows device. If an attacker has RDP credentials for several devices on the network, they can easily open multiple RDP sessions to laterally move across the network.
The system might change the risk score for this detection.
Kill Chain
Risk Score
37
After an attacker compromises a device on a network, they might start searching for databases, file servers, and other types of critical assets to compromise. Remote service protocols, such as RDP, can enable an attacker to laterally move across a network, from one compromised device to the next. First, the attacker sends a connection request over RDP to one or more devices. If one of these devices has Remote Desktop Services enabled, the attacker might be able to log in with stolen Windows or Active Directory credentials. Each authenticated RDP session enables the attacker to remotely access information and transfer files, helping them get closer to achieving their ultimate attack campaign objective, such as data exfiltration.
Disable RDP unless required
Only allow incoming external RDP connections from trusted devices
Remove the default local administrators group from the list of approved RDP groups and add specific users to the list
Enforce multi-factor authentication for remote logins
Implement network segmentation and the principle of least privilege to minimize the damage caused by a compromised device
