Remote Desktop Protocol
Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citatio...
BY SOURCE
PROCEDURES (31)
Auto-extracted: 5 detections for registry
Auto-extracted: 4 detections for network connection monitoring
Auto-extracted: 3 detections for persist
Auto-extracted: 3 detections for remote
Auto-extracted: 3 detections for unusual
Auto-extracted: 3 detections for exfiltrat
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for remote
Auto-extracted: 2 detections for lateral
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for tunnel
Auto-extracted: 1 detections for tunnel
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for general monitoring
Auto-extracted: 1 detections for registry
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for process creation monitoring
Auto-extracted: 1 detections for tunnel
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for service