type: attack-pattern
spec_version: 2.1
id: attack-pattern--51dea151-0898-4a45-967c-3ebee0420484
created: 2017-05-31T21:30:59.769Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1076
external_id: T1076
source_name: capec
url: https://capec.mitre.org/data/definitions/555.html
external_id: CAPEC-555
source_name: TechNet Remote Desktop Services
description: Microsoft. (n.d.). Remote Desktop Services. Retrieved June 1, 2016.
url: https://technet.microsoft.com/en-us/windowsserver/ee236407.aspx
source_name: Alperovitch Malware
description: Alperovitch, D. (2014, October 31). Malware-Free Intrusions. Retrieved November 4, 2014.
url: http://blog.crowdstrike.com/adversary-tricks-crowdstrike-treats/
source_name: RDP Hijacking Korznikov
description: Korznikov, A. (2017, March 17). Passwordless RDP Session Hijacking Feature All Windows versions. Retrieved December 11, 2017.
url: http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html
source_name: RDP Hijacking Medium
description: Beaumont, K. (2017, March 19). RDP hijacking — how to hijack RDS and RemoteApp sessions transparently to move through an organisation. Retrieved December 11, 2017.
url: https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
source_name: Kali Redsnarf
description: NCC Group PLC. (2016, November 1). Kali Redsnarf. Retrieved December 11, 2017.
url: https://github.com/nccgroup/redsnarf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:46.864Z
name: Remote Desktop Protocol
description: Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). (Citation: TechNet Remote Desktop Services) There are other implementations and third-party tools that provide graphical access [Remote Services](https://attack.mitre.org/techniques/T1021) similar to RDS.

Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the [Accessibility Features](https://attack.mitre.org/techniques/T1015) technique for Persistence. (Citation: Alperovitch Malware)

Adversaries may also perform RDP session hijacking which involves stealing a legitimate user's remote session. Typically, a user is notified when someone else is trying to steal their session and prompted with a question. With System permissions and using Terminal Services Console, c:\windows\system32\tscon.exe [session number to be stolen], an adversary can hijack a session without the need for credentials or prompts to the user. (Citation: RDP Hijacking Korznikov) This can be done remotely or locally and with active or disconnected sessions. (Citation: RDP Hijacking Medium) It can also lead to [Remote System Discovery](https://attack.mitre.org/techniques/T1018) and Privilege Escalation by stealing a Domain Admin or higher privileged account session. All of this can be done by using native Windows commands, but it has also been added as a feature in RedSnarf. (Citation: Kali Redsnarf)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: lateral-movement
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Matthew Demaske, Adaptforward
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_version: 1.1