kevmap

Techniques › T1021 › T1021.001

T1021.001 Remote Desktop Protocol

lateral movement — Windows · attack.mitre.org · JSON

1
MITRE detection strategy
1
analytics
16
Sigma rules tagged attack.t1021.001
2
KEV CVEs mapped here
<p>Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.</p><p>Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).</p><p>Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the Accessibility Features or Terminal Services DLL for Persistence.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

CVEVendor / productMapping typeStateAdded
CVE-2024-53704SonicWall SonicOS secondary impact Mapped2025-02-18
CVE-2023-22952SugarCRM Multiple Products secondary impact Stale2023-02-02

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1021.001

Potential Tampering With RDP Related Registry Keys Via Reg.EXE hightest
Author: pH-T (Nextron Systems), @Kostastsale, TheDFIRReport · 2022-02-12 (modified 2025-11-22) · logsource: product=windows category=process_creation · 0d5675be-bc88-4172-86d3-1e96a4476536
Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values
Techniques: T1021.001T1112
Publicly Accessible RDP Service hightest
Author: Josh Brower @DefensiveDepth · 2020-08-22 (modified 2024-03-13) · logsource: product=zeek service=rdp · 1fc0809e-06bf-4de3-ad52-25e5263b7623
Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service.
Techniques: T1021.001
Hermetic Wiper TG Process Patterns hightest
Author: Florian Roth (Nextron Systems) · 2022-02-25 (modified 2022-09-09) · logsource: product=windows category=process_creation · 2f974656-6d83-4059-bbdf-68ac5403422f
Detects process execution patterns found in intrusions related to the Hermetic Wiper malware attacks against Ukraine in February 2022
Techniques: T1021.001
Port Forwarding Activity Via SSH.EXE mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2022-10-12 (modified 2024-03-05) · logsource: product=windows category=process_creation · 327f48c1-a6db-4eb8-875a-f6981f1b0183
Detects port forwarding activity via SSH.exe
Techniques: T1572T1021.001T1021.004
Suspicious Plink Port Forwarding hightest
Author: Florian Roth (Nextron Systems) · 2021-01-19 (modified 2022-10-09) · logsource: product=windows category=process_creation · 48a61b29-389f-4032-b317-b30de6b95314
Detects suspicious Plink tunnel port forwarding to a local port
Techniques: T1572T1021.001
RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class mediumexperimental
Author: Daniel Koifman (KoifSec), Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-15 · logsource: product=windows category=process_creation · 4b8f6d3a-9c5e-4f2a-a7d8-6b9c3e5f2a8d
Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell. In PowerShell one-liner commands, the "SetAllowTSConnections" method of the "Win32_TerminalServiceSetting" class may be used to enable or disable RDP. In WMIC, the "rdtoggle" alias or "Win32_TerminalServiceSetting" class may be used for the same purpose.
Techniques: T1021.001T1047
RDP Login from Localhost hightest
Author: Thomas Patzke · 2019-01-28 (modified 2022-10-09) · logsource: product=windows service=security · 51e33403-2a37-4d66-a574-1fda1782cc31
RDP login with localhost source address may be a tunnelled login
Techniques: T1021.001
OpenCanary - RDP New Connection Attempt highexperimental
Author: Marco Pedrinazzi (@pedrinazziM) · 2026-01-06 · logsource: product=opencanary category=application · 598290cf-5932-45cd-9123-be1e05ab4f2e
Detects instances where an RDP service on an OpenCanary node has had a connection attempt.
Techniques: T1133T1021.001
RDP over Reverse SSH Tunnel WFP hightest
Author: Samir Bousseaden · 2019-02-16 (modified 2022-09-02) · logsource: product=windows service=security · 5bed80b6-b3e8-428e-a3ae-d3c757589e41
Detects svchost hosting RDP termsvcs communicating with the loopback address
Techniques: T1090.001T1090.002T1021.001
RDP Over Reverse SSH Tunnel hightest
Author: Samir Bousseaden · 2019-02-16 (modified 2024-03-12) · logsource: product=windows category=network_connection · 5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4
Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389
Techniques: T1572T1021.001
Denied Access To Remote Desktop mediumtest
Author: Pushkarev Dmitry · 2020-06-27 (modified 2021-11-27) · logsource: product=windows service=security · 8e5c03fa-b7f0-11ea-b242-07e0576828d9
This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop. Often, this event can be generated by attackers when searching for available windows servers in the network.
Techniques: T1021.001
New Remote Desktop Connection Initiated Via Mstsc.EXE mediumtest
Author: frack113 · 2022-01-07 (modified 2024-06-04) · logsource: product=windows category=process_creation · 954f0af7-62dd-418f-b3df-a84bc2c7a774
Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Techniques: T1021.001
RDP to HTTP or HTTPS Target Ports hightest
Author: Florian Roth (Nextron Systems) · 2022-04-29 (modified 2022-07-14) · logsource: product=windows category=network_connection · b1e5da3b-ca8e-4adf-915c-9921f3d85481
Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443
Techniques: T1572T1021.001
Outbound RDP Connections Over Non-Standard Tools hightest
Author: Markus Neis · 2019-05-15 (modified 2024-02-09) · logsource: product=windows category=network_connection · ed74fe75-7594-4b4b-ae38-e38e3fd2eb23
Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement. An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.
Techniques: T1021.001
Suspicious RDP Redirect Using TSCON hightest
Author: Florian Roth (Nextron Systems) · 2018-03-17 (modified 2023-05-16) · logsource: product=windows category=process_creation · f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb
Detects a suspicious RDP session redirect using tscon.exe
Techniques: T1563.002T1021.001
User Added to Remote Desktop Users Group hightest
Author: Florian Roth (Nextron Systems) · 2021-12-06 (modified 2022-09-09) · logsource: product=windows category=process_creation · ffa28e60-bdb1-46e0-9f82-05f7a61cc06e
Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".
Techniques: T1133T1136.001T1021.001

Rules tagged at the parent level (attack.t1021) 11

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

OpenCanary - SMB File Open Request hightest
Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 22777c9e-873a-4b49-855f-6072ab861a52
Detects instances where an SMB service on an OpenCanary node has had a file open request.
Techniques: T1021T1005
OpenCanary - FTP Login Attempt hightest
Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 6991bc2b-ae2e-447f-bc55-3a1ba04c14e5
Detects instances where an FTP service on an OpenCanary node has had a login attempt.
Techniques: T1190T1021
Psexec Execution mediumtest
Author: omkar72 · 2020-10-30 (modified 2023-02-28) · logsource: product=windows category=process_creation · 730fc21b-eaff-474b-ad23-90fd265d4988
Detects user accept agreement execution in psexec commandline
Techniques: T1569T1021
HackTool - NetExec Execution highexperimental
Author: Chirag Damani · 2026-03-29 · logsource: product=windows category=process_creation · 7638e5fe-600c-4289-a968-f49dd537ec7d
Detects execution of the hacktool NetExec. NetExec (formerly CrackMapExec) is a widely used post-exploitation tool designed for Active Directory penetration testing and network enumeration In enterprise environments, the use of NetExec is considered suspicious or potentially malicious because it enables attackers to enumerate hosts, exploit network services, and move laterally across systems. Threat actors and red teams commonly use NetExec to identify vulnerable systems, harvest credentials, and execute commands remotely.
Techniques: T1018T1021
Potential Remote Desktop Tunneling mediumtest
Author: Tim Rauch, Elastic (idea) · 2022-09-27 · logsource: product=windows category=process_creation · 8a3038e8-9c9d-46f8-b184-66234a160f6f
Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.
Techniques: T1021
Privilege Escalation via Named Pipe Impersonation hightest
Author: Tim Rauch, Elastic (idea) · 2022-09-27 (modified 2022-12-30) · logsource: product=windows category=process_creation · 9bd04a79-dabe-4f1f-a5ff-92430265c96b
Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.
Techniques: T1021
OpenCanary - VNC Connection Attempt hightest
Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 9db5446c-b44a-4291-8b89-fcab5609c3b3
Detects instances where a VNC service on an OpenCanary node has had a connection attempt.
Techniques: T1021
OpenCanary - SSH New Connection Attempt hightest
Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · cd55f721-5623-4663-bd9b-5229cab5237d
Detects instances where an SSH service on an OpenCanary node has had a connection attempt.
Techniques: T1133T1021T1078
OpenCanary - SNMP OID Request hightest
Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · e9856028-fd4e-46e6-b3d1-10f7ceb95078
Detects instances where an SNMP service on an OpenCanary node has had an OID request.
Techniques: T1016T1021
New RDP Connection Initiated From Domain Controller hightest
Author: Josh Nickels · 2024-05-10 · logsource: product=windows category=network_connection · fda34293-718e-4b36-b018-38caab0d1209
Detects an RDP connection originating from a domain controller.
Techniques: T1021
OpenCanary - SSH Login Attempt hightest
Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · ff7139bc-fdb1-4437-92f2-6afefe8884cb
Detects instances where an SSH service on an OpenCanary node has had a login attempt.
Techniques: T1133T1021T1078