T1021.001 Remote Desktop Protocol
sub-techniqueEnterpriseAdversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the Accessibility Features or Terminal Services DLL for Persistence.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-technique of
The broader entity this sits under.
mitigations
ATT&CK mitigations that reduce this.
detected by (4)
Data components that detect this.
countered by (D3FEND)
D3FEND countermeasures that counter this.
Detect
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.AAIdentity Management, Authentication, and Access Controlmoderate · backed by 11 of 23 mapped controls
- DE.CMContinuous Monitoringmoderate · backed by 5 of 23 mapped controls
- PR.DSData Securitymoderate · backed by 5 of 23 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (23)
Security controls that mitigate this.
known-exploited CVEs (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-53704US | critical9.8OT critical | KEV | ||
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication. | ||||
| CVE-2023-22952US | high8.8OT critical | KEV | ||
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. | ||||
groups (39)
Threat groups associated with this.
software (18)
Malware and tools associated with this.
campaigns (9)
Campaigns that use this.
Detected by (Sigma) (16)
Sigma detection rules related to this.
source
Where this definition is published.