T1021.001_remote-desktop-protocol

T1021.001 Remote Desktop Protocol

Sub-technique of: T1021

High-Level Description

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).

Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the Accessibility Features or Terminal Services DLL for Persistence.

Kill Chain Phase

• Lateral Movement (TA0008)

Platforms: Windows

What to Check

• Identify if Remote Desktop Protocol technique is applicable to target environment
• Check Windows systems for indicators of Remote Desktop Protocol
• Verify mitigations are bypassed or absent (8 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: RDP to DomainController

Attempt an RDP session via Remote Desktop Application to a DomainController.

Supported Platforms: windows

$Server=#{logonserver}
$User = Join-Path #{domain} #{username}
$Password="#{password}"
cmdkey /generic:TERMSRV/$Server /user:$User /pass:$Password
mstsc /v:$Server
echo "RDP connection established"

Dependencies:

• Computer must be domain joined

Atomic Test 2: Changing RDP Port to Non Standard Port via Powershell

Changing RDP Port to Non Standard Port via Powershell

Supported Platforms: windows Elevation Required: Yes

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "PortNumber" -Value #{NEW_Remote_Port}
New-NetFirewallRule -DisplayName 'RDPPORTLatest-TCP-In' -Profile 'Public' -Direction Inbound -Action Allow -Protocol TCP -LocalPort #{NEW_Remote_Port}

Atomic Test 3: Changing RDP Port to Non Standard Port via Command_Prompt

Changing RDP Port to Non Standard Port via Command_Prompt

Supported Platforms: windows Elevation Required: Yes

reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d #{NEW_Remote_Port} /f
netsh advfirewall firewall add rule name="RDPPORTLatest-TCP-In" dir=in action=allow protocol=TCP localport=#{NEW_Remote_Port}

Atomic Test 4: Disable NLA for RDP via Command Prompt

Disables network-level authentication (NLA) for RDP by changing a registry key via Command Prompt Disabling NLA for RDP can allow remote user interaction with the Windows sign-in screen prior to authentication. According to Microsoft, Flax Typhoon actors used this technique implementation to achieve persistence on victim systems: https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/ See also: https://github.com/EmpireProject/Empire/blob/master/lib/modules/powershell/management/enable_rdp.py

Supported Platforms: windows

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /d 0 /t REG_DWORD /f

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by:

1. Identify Attack Surface: Determine if the target environment is susceptible to Remote Desktop Protocol by examining the target platforms (Windows).

2. Assess Existing Defenses: Review whether mitigations for T1021.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Remediation Guide

M1047 Audit

Audit the Remote Desktop Users group membership regularly. Remove unnecessary accounts and groups from Remote Desktop Users groups.

M1035 Limit Access to Resource Over Network

Use remote desktop gateways.

M1030 Network Segmentation

Do not leave RDP accessible from the internet. Enable firewall rules to block RDP traffic between network security zones within a network.

M1028 Operating System Configuration

Change GPOs to define shorter timeouts sessions and maximum amount of time any single session can be active. Change GPOs to specify the maximum amount of time that a disconnected session stays active on the RD session host server.

M1042 Disable or Remove Feature or Program

Disable the RDP service if it is unnecessary.

M1018 User Account Management

Limit remote user permissions if remote access is necessary.

M1032 Multi-factor Authentication

Use multi-factor authentication for remote logins.

M1026 Privileged Account Management

Consider removing the local Administrators group from the list of groups allowed to log in through RDP.

Detection

Multi-event Detection Strategy for RDP-Based Remote Logins and Post-Access Activity

Risk Assessment

CWE Categories

References

• Alperovitch Malware
• TechNet Remote Desktop Services
• Atomic Red Team - T1021.001
• MITRE ATT&CK - T1021.001