Technique:  Remote Services:Remote Desktop Protocol
The It group is known to have used RDP during operations.
It enables the Remote Desktop Protocol for persistence. It has also interacted with compromised systems to browse and copy files through RDP sessions.
It has been seen using RDP for lateral movement and persistence, in some cases employing the rdpwinst tool for mangement of multiple sessions.
It used RDP for lateral movement.
It has used RDP during operations.
It has used Remote Desktop to log on to servers interactively and manually copy files to remote hosts.
During C0015, the threat actors used RDP to access specific network hosts of interest.
During C0018, the threat actors opened a variety of ports to establish RDP connections, including ports 28035, 32467, 41578, and 46892.
It enables concurrent Remote Desktop Protocol (RDP) sessions.
It has used RDP to access targeted systems.
It has used Remote Desktop Protocol to conduct lateral movement.
Cobalt Strike can start a VNC-based remote desktop server and tunnel the connection through the already established C2 channel.
DarkComet can open an active screen of the victim’s machine and take control of the mouse and keyboard.
It has moved laterally via RDP.
It has used RDP to move laterally to systems in the victim environment.
It has remotely accessed compromised environments via Remote Desktop Services (RDS) for lateral movement.
It used RDP to move laterally in victim networks.
It has used RDP to move laterally in victim environments.
It has used RDP for lateral movement.
It has used RDP to log in and move laterally in the target environment.
It has used remote desktop sessions for lateral movement.
Imminent Monitor has a module for performing remote desktop access.
jRAT can support RDP control.
It has used RDP for direct remote point-and-click access.
Koadic can enable remote desktop on the victim's machine.
It malware SierraCharlie uses RDP for propagation.
It has targeted RDP credentials and used it to move through the victim environment.
It has used Remote Desktop Services to copy tools on targeted systems.
It has used RDP connections to move across the victim network.
njRAT has a module for performing remote desktop access.
It has used Remote Desktop Protocol for lateral movement. The group has also used tunneling tools to tunnel RDP into the environment.
It attempted to use RDP to move laterally.
Pupy can enable/disable RDP connection and can start a remote desktop session using a browser web socket client.
Pysa has laterally moved using RDP connections.
QuasarRAT has a module for performing remote desktop access.
Revenge RAT has a plugin to perform RDP access.
SDBbot has the ability to use RDP to connect to victim's machines.
ServHelper has commands for adding a remote desktop user and sending RDP traffic to the attacker through a reverse SSH tunnel.
It has used RDP for lateral movement.
During the SolarWinds Compromise, It used RDP sessions from public-facing systems to internal servers.
It utilized RDP throughout an operation.
WarzoneRAT has the ability to control an infected PC using RDP.
It has used RDP for lateral movement and to deploy ransomware interactively.
zwShell has used RDP for lateral movement.
ZxShell has remote desktop functionality.