Remote
Desktop Protocol:
Configuring remote accessfor a secure workforce
Using Remote Desktop Protocol (RDP) to manage yournetwork through a crisis? Make sure you are limiting yourrisk by leveraging good practices, authentication tools, andthe existing knowledge base.
The COVID-19 pandemic pushed enterprises around the world to send
their people home and leverage any tools possible to continue operations
remotely. This included RDP technology which has since seen increasing
abuse. Numerous instances have emerged of attackers finding ways to
exploit poorly configured settings or weak passwords to gain access tocompany networks.
Once inside, attackers have an open door to do almost anything, including
the theft of intellectual property or other sensitive information andencrypting it for ransom.

Author: Aryeh Goretsky
Contributor: Rene Holt

July 2022

AUTHOR’S NOTE:This is a revised edition of ESET’s white paper RDP: Configuring Security
For A Remote, But Not Distant Future, and was updated approximately
two years after initial publication, which took place near the start of the
global COVID-19 pandemic in April 2020. Since then, business has changed
dramatically, with work from home becoming the new norm in manyindustries and offices, including many for whom work has always been
performed on-premises.
This shift to a remote workforce has meant the deployment of manytechnologies rapidly and in quantities that would have been unimaginablepre-pandemic. Laptop computers, VPNs, and two-factor authentication
are among the technologies that have been widely deployed, oftentimes
correctly but sometimes not, leading to breaches, theft, and the destruction of data. One technology that has seen an uptick in use is RDP, whichallows desktops and servers at the office to be accessed from home.
Even when a technology like RDP is deployed correctly, unpatched vulnerabilities can make it insecure when it is internet-facing.

In this revised paper, the author will update us
on how attacks progressed throughout 2020 and 2021 using RDP.

©

1992 - 2022 ESET, spol. s. r. o. - All rights reserved. Trademarks used herein are trademarks or registered trademarks of ESET, spol. s. r. o.
or ESET North America. All other names and brands are registered trademarks of their respective companies.

What do attackers
do with RDP?
In the past few years, ESET has seen a rising number of incidents in which attackers
connected to Windows servers over the internet using RDP and logged on asadministrators. This implies various attack vectors, including vulnerabilities such as
BlueKeep, phishing, credential stuffing, password spraying, brute-force attacks, andpoorly configured access to internal systems.

Once attackers are logged into a serverThis is not a complete list of all they canas an administrator, they will typicallydo, nor are they necessarily going toperform some reconnaissance toperform all of these activities. While thedetermine what the server is used for,exact frequency, sequence, and natureby whom, and when it is being used.

of what attackers will do varies greatly,

Then they typically perform additional

four of the most common are:malicious actions like the following:●clearing log files containing evidenceof their presence on the system●disabling scheduled backups andshadow copies●

disabling security software or setting
up exclusions in it (which is allowed
for administrators)●

downloading and installing various
programs onto the server●

erasing or overwriting old backups, if
they are accessible●

exfiltrating data from the server●

securely overwriting and deletingbusiness-critical data1●

installing coin-mining programs inorder to generate cryptocurrency,such as Monero●

installing ransomware in order
to extort money from theorganization, often to be paid using
cryptocurrency, such as Bitcoin●

downloading confidential files andthreatening to share them unless
an extortion is paid●in some cases, attackers might
install additional remote-control
software to maintain access(persistence) to compromised
servers in case their RDP activities
are discovered and terminatedNotable malicious
RDP activity
One prolific ransomware, GandCrab, which

dependencies as both teams and individual us-

operated until May 2019, used a Ransomware-ers depend on admins for help with everything

as-a-Service (RaaS) business model in whichfrom licensing and updates to security.

the developers contracted affiliates to further

RDP vulnerabilities open

distribute the malware. GandCrab targeted

a big door to risk

managed service providers (MSPs), making
the initial breach via exposed RDP endpoints

Attacks via RDP have been slowly, but steadily,

and then commandeering the MSP’s remoteincreasing and become the subject of a num-

management tools to deploy ransomware andber of governmental advisories from the FBI,

extort multiple customers at once.

the UK’s NCSC, Canada’s CCCS, and Australia’s

After GandCrab’s operators announced their

ACSC, to name a few.

retirement some saw the rise of Sodinokibi
at about the same time as the new face ofGandCrab with the same actors at work.

In May 2019, the floodgates opened

Although there are some similarities between

with the arrival of CVE-2019-0708, aka

the source code of GandCrab and Sodinokibi,

BlueKeep, a security vulnerability in

our experts think that the differences indicate

Remote Desktop Services affecting:rather that GandCrab’s source code may havebeen sold to a different group that developed
it further to become Sodinokibi. Sodinokibi
ransomware appeared just as GandCrab started
to suspend its operations, essentially replacing
GandCrab and using similar tactics, techniques
and procedures as its predecessor to target
MSPs via RDP.
The MSP connection is notable for enterprises
too, as MSPs hold the keys to the kingdom forthousands of SMBs (including their business
relationships), and even some enterprises. On
the MSP client side, businesses face similar

2→

WINDOWS 2000→

WINDOWS XP→

WINDOWS VISTA→

WINDOWS 7→

WINDOWS SERVER 2003→

WINDOWS SERVER 2003 R2→

WINDOWS SERVER 2008→

WINDOWS SERVER 2008 R2

Windows 8 and Windows Server

from 2019–2020 suggests there were many2012 and later were unaffected byvulnerable systems still in use.

BlueKeep, but in August, 2019, two

The BlueKeep and DejaBlue vulnerabilities allow

additional wormable vulnerabilities

attackers to run arbitrary program code on

in Remote Desktop Services allowing

their victims’ computers. While attackers al-

remote code execution via RDP wereready pose a formidable threat with automatedidentified affecting:tools at hand to speed up attacks, these vulner-→ Windows 7

abilities are wormable, which means that an→ Windows 8.1

attack could spread itself automatically acrossnetworks without any intervention by users,→ Windows 10

just as the Win32/Diskcoder.C (aka NotPetya)→ Windows Server 2008 R2

and Conficker worms have in the past.

→ Windows Server 2012

ESET offers a free BlueKeep (CVE-2019-0708)→ Windows Server 2012 R2

detection tool to help identify systems vulnerable to→ Windows Server 2016

exploitation via RDP. For instructions on its use andto download a copy, see this article.

→ Windows Server 2019
→ Microsoft Remote Desktop for Mac

The exploitation of wormable vulnerabilities isgenerally considered a severe issue. BlueKeep→ Microsoft Remote Desktop for iOS

and DejaBlue scored the highest severity level1→ Microsoft Remote Desktop for Androidof “critical” reaching a 9.8 in the Common
Vulnerability Scoring System (CVSS).

Known individually as CVE-2019-1181 and CVE-

Microsoft credited NCSC for reporting the2019-1182 by Microsoft, these vulnerabilities

BlueKeep vulnerability and issued a blogpost

have been referred to as DejaBlue because ofstrongly recommending users to install thetheir similar nature. Unlike BlueKeep, DejaBlue

patches, even for out-of-support operating sys-

was discovered internally by Microsoft, so there

tems such as Windows XP and Windows Server

were no known instances of it being exploited

2003. Concerns about a wormable exploit werein the wild prior to discovery.

so high at the time that, in June 2019, the US

While some of these are legacy systems, andNational Security Agency issued a rare advi-in most cases are either no longer supported

sory recommending installation of Microsoft’s

or only have limited vendor support, telemetry

patches for the flaw.

¹ As a CNA, Microsoft defined the vector string and from that a score and severity level was automatically derived.

3

Although DejaBlue had thequarter of 2021, a decrease of about 44%. Whilesame level of severity as

there are likely several underlying causes for thisdecrease in exploitation attempts using BlueKeep,

BlueKeep, DejaBlue did notsuch as the patching of affected operating sys-

trigger the same level oftems and the deployment of security tools at theattention because it was likely

network perimeter, it should be kept in mind thatnot known to third parties prior

RDP attacks are still on the rise, as noted in thenext section below.

to Microsoft’s disclosure.
No major escalations in BlueKeep activ-

nal group automated exploitation, albeit
without a high success rate.

514 778386 250365 3742021-Q3

2021-Q4

the feared wormable attack, the crimi-

2021-Q2

Monero cryptomining software. While not

495 674

ers, these attackers successfully installed

2021-Q1

0524 581

the remaining 9% of vulnerable comput-

200k

2020-Q4

or Blue Screen of Death). However, on

570 680

ing with a stop error (aka a bug check400k

2020-Q3

about 91% of vulnerable computers crash-

651 197

These attacks had limited success, with

600k

2020-Q2

ing to deploy a BlueKeep exploit at scale.

610 511when a hacker group was seen attempt-

800k

2020-Q1

ity were reported until November 2019

Figure 1. CVE-2019-0708 “BlueKeep” detections worldwide(source: ESET telemetry)

The good news, in as much as such that canbe said about a vulnerability like BlueKeep,is that ESET has steadily seen a decrease

As this is not one of ESET’s threat intelligencein detections of attacks attempting toreports, we will not be providing detailed technicalexploit this vulnerability, from a height ofdescriptions of these vulnerabilities and insteadover 651,000 attacks in the second quarter

focus on what should be done to protect networksof 2020 to just over 365,000 in the fourth

against this threat.

4Beyond BlueKeep,
RDP attacks continue
unabated
While we have seen a decrease inapproximately 1.97 billion attempted connections. Just

BlueKeep attacks, we have not seen

two years later, in the fourth quarter of 2021, abouta similar trend in RDP attacks over-

166.37 billion connection attempts were made, whichall, and RDP continues to be a prime

is an increase of over 8,400%.

target for attackers seeking ingressto networks for reasons ranging from
corporate espionage to ransomware
and perhaps even nation-state actions.

The sheer volume of increase in these attacks indicates
they must be highly automated, while the number
indicates that attackers can derive tremendous value
from compromising a network.

Using malicious software and attack-

4B

10 B

13 B

17 B

25 B

79 B

166 B

2020-Q3

2020-Q4

2021-Q1

2021-Q2

2021-Q3

2021-Q4

200B

2020-Q2

unwanted software has been a prob-

2B

nothing new. Adware and potentially

2020-Q1

ing networks for financial gain arelem for over twenty years, as has seizing computing resources to perform
distributed denial-of-service (DDoS)

150B

attacks, but the rise of ransomware
and theft of corporate secrets (often

100Bwith subsequent extortion) has massively increased attempted network
intrusions using RDP.
Whether it’s brute-force or password
spraying attacks, or other forms of

50B0

attempting to gain access via RDP, theincrease in the number of malicious
connection attempts is mind-boggling. To give some idea of how thescale of attempted malicious RDP
connections has increased, in the

Figure 2. Malicious RDP connection attempts
detected worldwide (source: ESET telemetry).
Absolute numbers are rounded

first quarter of 2020, ESET detected5Defending against
RDP-borne attackers
So, what can you do? Well, the first thing, is to stop connecting directly to yourservers over the internet using RDP or at least minimize this whenever possible.
This may be problematic for many businesses, especially now that many employees
may still be working remotely and perhaps anticipate remaining in that state in theforeseeable future.

Let us stress, if you are still running unsup-

recommendations below should take a backported operating systems like Windows Serverseat to your business updating to platforms

2008 or Windows 7 (which are no longer sup-that are fully supported by their respective

ported as of January 2020), or do not havevendors.

a strong patching regimen for Windows 8.1,

For those running up-to-date platforms, theWindows 10, or their comparable Windows

situation does not mean that you have to im-Server versions, yet have machines running

mediately stop using RDP, but that you need tothese platforms that are directly accessible

take additional steps to secure it as soon and

via RDP, then you are at risk of attack and you

as thoroughly as possible. To this end, we haveshould take remediation steps immediately. By

created a table with the top 15 steps you canrunning these platforms, your threat surface

take now to begin securing your computers

has multiplied by a substantial factor, and thefrom RDP-based attacks.

RECOMMENDATION FOR SECURING RDPREASON

1

Disallow external connections to local machines on
port 3389 (TCP/UDP) at the perimeter firewall*

Blocks RDP access from the internet
altogether.

2

Test and deploy patches for the CVE-2019-0708(BlueKeep) vulnerability and enable Network
Level Authentication as quickly as possible.

Installing Microsoft’s patch and following
their prescriptive guidelines helps
ensure devices are protected against the
BlueKeep vulnerability.

6
6

3
4

For all accounts that can be logged into via RDP,
require complex passwords (a long passphrase
containing 15+ characters with no phrases related
to the business, product names, or users is
mandatory).

For accessing servers, use unique passwords for
local accounts with admin rights (e.g., by using LAPS
or a robust password manager service)*Also:
Restrict server access rights to a limited group of users.

Protects against password-guessing
and credential-stuffing attacks. It is
incredibly easy to automate these andincreasing password length makes them
exponentially more resistant to attacks.

In addition to the aforementioned
reason, it also reduces the attack
surface of servers by limiting the users
who can access them.

5

Enable account lockout policies in Windows toprevent password-guessing attempts.

Prevents manual attacks such as
credential stuffing, password-guessing,and password sprays that fall below
brute force detection thresholds.
Enabling account lockout policies is
now the default in Windows 11, but
can also be enabled in Windows 10.

6

Set the RDP client connection’s encryption
level to “high”, if possible. If not, use the highest
encryption level available for connections.

Use 128-bit encryption for all clientserver communications, if possible.

7

Install a multi-factor authentication (MFA)
solution, such as ESET Secure Authentication, andrequire it for all accounts that can be logged into
via RDP, as well as for all administrator accounts.

Requires a second layer ofauthentication only available toemployees via mobile phone, token,
or other mechanism for logging into
computers.

8

Install a virtual private network (VPN) gateway
to broker all RDP connections from outside yourlocal network.

Prevents RDP connections between theinternet and your local network. Allows
you to enforce stronger identification
and authentication requirements forremote access to computers.

9

Ensure that your endpoint security softwaresettings are locked with a strong password
unrelated to administrative and service accounts.

Prevents unauthorized disabling of
endpoint protection should an attacker
gain administrator access in yournetwork.

Enable the detection of potentially unsafe
applications in your endpoint security software.

This blocks unsafe applications,
including those that can terminate
processes, especially those of yoursecurity products.

10

7
7

11

Make sure brute-force attack protection isenabled in your endpoint security software.

This detects external IP addresses
that indicate an incoming brute-force
attack on RDP or SMB services.

12

Enable exploitation blocking in endpoint
security software, which is a non-signaturebased anomaly detection technology thatmonitors the behavior of commonly targeted
applications.

Many endpoint security programs
can also block exploitation
techniques. Verify that thisfunctionality is enabled.

13

Isolate any insecure computer that needs to beaccessed from the internet using RDP.

Implement network isolation to block
vulnerable computer(s) from the restof the network.

14

Replace insecure computers.

If a computer cannot be patchedagainst the BlueKeep vulnerability,
plan for its timely replacement.

Consider instituting GeoIP blocking at the VPN
gateway.

If staff and vendors are in the same
country, or a short list of countries,
consider blocking access fromother countries in order to prevent
connections from foreign attackers.

15

This table is loosely based on order of importance and ease of implementation, but that can varydepending upon your organization. Some may not be applicable or may be more practical to doin a different order. Your organization may need to fine-tune these or take additional steps.

*By default, RDP operates on port 3389. If you have changed this port to a different value then that is the port that should be blocked.

NOTE: While changing the default port usedon non-standard ports is a well understoodby RDP can stop simple reconnaissance fromconcept.2,3 Port scanning services like Shodan

low-skilled adversaries, it is widely known

even recommend not searching by port any-that many organizations simply change themore, due to protocols like RDP being com-default port. The ability to detect RDP traffic

monly used on non-standard ports.4

2

Snort Rule Sid 1-49040. Available via: <https://www.snort.org/rule_docs/1-49040>

3

Wireshark Wiki: RDP. Available via: <https://wiki.wireshark.org/RDP>

4

Matherly, John. Don’t Search by Port. Available via: <https://blog.shodan.io/dont-search-by-port/>

8

How ESET helps
protect your RDP
Some good first steps are making sure that your endpoint security software is A.
up-to-date, and B. detects BlueKeep exploits. BlueKeep exploits are detected as
RDP/Exploit.CVE-2019-0708 by ESET’s Network Attack Protection module, which
is an extension of ESET’s firewall technology present in ESET’s endpoint protection
products version 7 and higher.

Another layer of technology critical to protect-

RDP requires several (procedural) steps, the use

ing RDP is Exploit Blocker, which monitors typ-of multi-factor authentication (MFA) is perhaps

ically exploitable applications, such as brows-

most crucial because it acts as a protection

ers, document readers, email clients, legacy

against weak or brute-forced passwords. By

Flash apps, Java, and more. Instead of aiming

focusing on authentication to a system or plat-

only at particular CVE identifiers, it focuses onform, in this case RDP, you protect one of the

exploitation techniques. When triggered, themost critical systems you have in your businessthreat is blocked immediately on the machine.

for managing the security of both your network
and individual users.

In addition to using multi-layered protection,
we would advise you to put security processes

Our MFA solution, ESET Secure Authenticationin place that are as user-friendly as possible(ESA), protects RDP logins by adding multi-fac-

supported by easy-to-use tools. Since securing

tor authentication.

OTP:
369875369875Figure 3. ESET Secure Authentication in action

9

ESA also supports VPNs (itself a critical safe-a shared space. Leveraging ATT&CK and ex-

guard securing access), Windows logins (criticaltended detection and response (XDR) tools

for devices that contain sensitive data), cloud

together can be very useful for examining inservices such as Microsoft 365, Google Apps,

detail threats facing your network. Tools likeand Dropbox, and many other identity and ser-

ESET Inspect allow security admins to examine

vice providers.

detections, which reference ATT&CK for further
information, and set custom rules tailored toCentrally managed from the browser, ESA

each network.

works with all iPhone and Android mobile de-A danger with RDP-borne threats is having avices, and offers multiple authentication op-

limited opportunity to distinguish between

tions, including easy-to-use push notifications,legitimate and malicious account use. After all,mobile applications, hardware tokens, FIDO

once RDP credentials have been compromised,security keys, and other custom methods (via

any subsequent actions are performed in thethe ESA Software Development Kit). Ultimately,name of a legitimate account within your or-

ESA helps secure company data and cloud

ganization. XDR can play a critical role in such

assets in a simple, yet powerful, way and helps

scenarios where there is likely a need to linkbusinesses meet compliance requirements for

together several suspicious activities to identify

regulations such as GDPR.

the intrusion.

Lastly, adding full disk encryption as a fol-

Another example demonstrating the power

low-up to MFA is a great step too. ESET Fullof XDR can be seen by considering a BlueKeep

Disk Encryption provides powerful encryption

exploit that in some cases immediately crashedof system and non-system disks that is pro-the targeted system because it proved unre-tected by pre-boot authentication. The solu-

liable. In order for this exploit to have worked,

tion is managed natively via the ESET PROTECT

it may have needed to be paired with anothermanagement console, further improving yourexploit for an information disclosure vulnerabil-organization’s control over data security.

ity (for example, one of the many Adobe Flashvulnerabilities) that would reveal exploitable

Knowledge is power...

memory addresses. This could reduce the like-full security too

lihood of a crash and thus the exploit’s successrate as it otherwise frequently guessed invalid

Various RDP techniques and tactics can also

addresses.

be examined in the MITRE ATT&CK® knowledge base. While referenced by many vendors’

These types of malicious behaviors can beresearchers, ATT&CK brings much of this to

flagged with custom rules created within ESET

10

Inspect, the XDR-enabling component of thesourced via regular penetration testing, and

ESET PROTECT platform, ultimately triggering

checking suspicious behavior via a security infor-

an alarm and drawing the admin’s attention.

mation and event management (SIEM) tool or an

Additional network intelligence may also be

intrusion detection service (IDS).

CONCLUSIONCOVID-19 has changed the way organiza-

thought of as requiring employees to be attions work, not just temporarily throughout

the office will now be viewed as optimal can-the course of the pandemic, but forever.

didates for remote work. But, in order for that

Employers need to adjust not just to the de-to occur, remote workers need to have securemands of employees working from home now,access to the corporate network. ESET offers

but in the future as well.

a variety of solutions that can help businesses
provide secure access to corporate resources.

One thing the pandemic has shown us is thatmany jobs and tasks that formerly were

11

MORE TO KNOWABOUT SMB ATTACKS
Although not directly related to RDP,

third quarter of 2020 with nearly 15.4 million at-

Server Message Block (SMB) is anothertempted attacks, ESET saw a decline in 2021 of

network communications protocol fromattempts to exploit CVE-2017-0144, with just over 6.1

Microsoft. Originally developed in the early

million attempted attacks, a decline of just over 60%.

1990s for Windows NT, SMB allows the(SMBv1), the original standard for the pro-

8 633 703

6 216 183

6 100 755

2021-Q3

2021-Q4

EternalBlue affected just SMB version 1

2021-Q2of documents stolen from the agency.

14 576 491

02021-Q1

years before its theft within a tranche

15 003 531

it was allegedly used covertly for several

4 000 000

2020-Q4

veloped by the US National Security Agency,

15 393 216

as EternalBlue, was leaked. Reportedly de-

8 000 000

2020-Q3

In March 2017, CVE-2017-0144, also known

12 000 000

12 352 324

like RDP, it is subject to wormable attacks.

2020-Q2of as a “companion” protocol to RDP. And,

16 000 000

15 086 975

works. Because of this, it can be thought

2020-Q1

sharing of files and printers across net-

Figure 4. CVE -2017-0144 “EternalBlue” detections worldwide(Source: ESET telemetry)

tocol. SMB version 2 (SMBv2), released in
2006, and later versions were unaffected,
but SMBv1 was still widely in use.

As with CVE-2019-0708 (BlueKeep), there are likely

Microsoft promptly released a security

to be several underlying causes for this decrease

update for the vulnerability in March 2017,

in exploitation attempts; however, the three most

but two months later in May 2017, there

likely reasons are the rapid deprecation of SMBv1

were still many unpatched and unprotect-

to newer, more secure versions of the protocol; theed systems, and these were affected by thepatching of affected operating systems; and the de-WannaCryptor (also known as WannaCry

ployment of security tools throughout the network.

and WannaCrypt) wormable ransomware.
Even in 2018 and 2019 (one and two years
later, respectively), ESET was still seeing arise in attacks exploiting this vulnerability

Despite its age, SMBv1 may still be used in any
networks in order to support older versions ofMicrosoft Windows, or devices such as network
printers, scanners, multifunction devices, net-

Sometimes, though, ESET gets to be thework-attached storage (NAS) devices, industrial

bearer of good news. After peaking in theand laboratory equipment, and so forth.
12

Tips for securing SMB
To this end, we have created a table with the top seven steps you cantake to begin securing your computers from SMB-based exploits.

RECOMMENDATION FOR SECURING RDPREASON

1

Disallow external connections to local machines
on port 445 (TCP/UDP) at the perimeter firewall.

Blocks SMB access from the internet
altogether.

2

Identify which computers and devices on yournetwork still use SMBv1. Update them to only
use SMBv2/SMBv3.

Identify and remediate vulnerable
systems.

3

If the device(s) cannot be replaced, isolate fromthe internet as well as all internal computers
except those requiring access.

Implement network isolation to block
vulnerable computer(s) from the rest of
the network.

4

Replace insecure computers.

If a computer cannot be patched against
the EternalBlue vulnerability, plan for its
timely replacement.

5

Segment the network so that SMB traffic is
not allowed globally; limit SMB traffic to thosesubnets requiring it.

Prevents or delays network penetration,
slows or prevents spread of worms that
propagate via SMB.

6Make sure brute-force attack protection isenabled in your endpoint security software.

This detects external IP addresses thatindicate an incoming brute-force attack
on RDP or SMB services.

7

Enable exploitation blocking in endpoint
security software, which is a non-signaturebased anomaly detection technology thatmonitors the behavior of commonly-targeted
applications.

Prevents RDP connections between theinternet and your local network. Allows
you to enforce stronger identification andauthentication requirements for remote
access to computers.

13

About ESETFor more than 30 years, ESET® hasbeen developing industry-leading
IT security software and services todeliver comprehensive, multilayered
protection against cybersecurity
threats for businesses and consumers
worldwide. ESET has long pioneeredmachine learning and cloudtechnologies that prevent, detect andrespond to malware. ESET is a privately
owned company that promotes
scientiﬁc research and development
worldwide.

ESET IN NUMBERS

1bn+

internet users
protected

400k+

businesscustomers

200+

countries &territories

13

global R&D
centers

SOME OF OUR CUSTOMERS

protected by ESET
since 2017 more than
9,000 endpoints

protected by ESET
since 2016 more than
4,000 mailboxes

protected by ESET
since 2016 more than
32,000 endpoints

ISP security partner
since 2008 2 million
customer base