Log in Request a demo

Glossary

Remote Desktop Protocol (RDP).

Also called RDP, remote desktop, Windows Remote Desktop

In Short

Remote Desktop Protocol, or RDP, is a Windows feature that lets a person open an interactive session on another computer over a network. It is useful for administration and remote work. Attackers who hold valid credentials can use it in the same way.

Last updated October 9, 2026
Profile MapGlossary Term
  1. Also Called3other namesRDP · remote desktop · Windows Remote Desktop
  2. Related Terms3linked entriesLateral movement · Credential theft

What is Remote Desktop Protocol?

RDP lets a user log on to a remote system and work as if sitting at it. It is a Windows feature meant for legitimate remote access, such as administration.

How do attackers use it?

MITRE lists RDP as a lateral movement technique, covered under remote services. It says adversaries can use RDP to establish interactive sessions on target systems with valid credentials. Reasoning from this, RDP use depends on an account the attacker already holds, so it may come after a login has been obtained rather than serve as the first break-in.

Why does it matter?

Because RDP is a normal feature and the session uses a real account, the activity can look like ordinary administration. MITRE advises against leaving RDP accessible from the internet. Reasoning from this, an exposed RDP service can give attackers a place to try stolen credentials, and an internal one can help them spread across a network.

How can you reduce the risk?

MITRE lists these mitigations.

  • Do not leave RDP accessible from the internet.
  • Disable RDP if it is not needed.
  • Use multi-factor authentication for remote logins.
  • Remove unnecessary accounts from the Remote Desktop Users group, and consider excluding local administrators.
  • Use firewall rules between security zones and a remote desktop gateway to control access.
  • Set shorter timeouts and maximum session lengths through Group Policy.
  • Limit the privileges of remote users to what they need.

How can you detect misuse?

MITRE suggests watching for an RDP logon by a user that is followed within a short time by unusual process execution, file access or lateral movement. Looking at what happens after the login is more useful than looking at the login alone.

Is RDP the same as a VPN?

No. A VPN creates a protected network connection. RDP gives a remote interactive session on a particular computer. The two are often used together, but they do different jobs.

Is RDP the same as remote access software?

RDP is one kind of remote access, built into Windows. Other tools also give remote control but are separate products.

See also lateral movement, multi-factor authentication and credential theft.

Also Called.

  • NameRDP
  • Nameremote desktop
  • NameWindows Remote Desktop

Questions.

  • What is Remote Desktop Protocol (RDP)?

    RDP is a Windows feature that lets a person open an interactive session on another computer over a network. It is meant for legitimate remote access, such as administration and remote work.

  • How do attackers misuse RDP?

    MITRE lists RDP as a lateral movement technique. Attackers who already hold valid credentials can use it to open interactive sessions on target systems, so it often comes after a login has been obtained.

  • How can I reduce the risk of RDP?

    Do not leave RDP accessible from the internet, and disable it if it is not needed. Use multi-factor authentication for remote logins, a remote desktop gateway, and limit what remote users can do.

  • Is RDP the same as a VPN?

    No. A VPN creates a protected network connection, while RDP gives a remote interactive session on a particular computer. The two are often used together but do different jobs.

Sources

  1. 1 Remote Services: Remote Desktop Protocol, Sub-technique T1021.001 - Enterprise, MITRE ATT&CK
  2. 2 Remote Services, Technique T1021 - Enterprise, MITRE ATT&CK

In Our Research

  1. 1 RDP (Remote Desktop Protocol) Attacks Explained May 2026
  2. 2 Volt Typhoon advisory AA24-038A: what CISA says October 2026
  3. 3 From Disclosure to Exploit: How Fast Are Threat Actors Weaponizing New CVEs? July 2026
  4. 4 ‘Network Access for Sale’ on the Dark Web: The Anatomy of Initial Access Broker Listings June 2026
  5. 5 Fog Ransomware Technical Analysis April 2026
  6. 6 What Is Triple Extortion? The Anatomy of the Encryption + Leakage + DDoS Trio April 2026

Keep Exploring.

Knowledge Hub
Article WIZARD SPIDER: The Financial Empire Behind Global Ransomware Operations Wizard Spider profile: aliases such as FIN12 and GOLD BLACKBURN, activity since 2016, and its role in TrickBot, Ryuk, Conti and Black Basta operations. Open Article OldGremlin: A Stealthy Russian-Speaking Ransomware And Espionage Threat Group Evolving Into A Precision Striking APT OldGremlin is a Russian-speaking, financially motivated group that mixes ransomware with slow APT-style intrusions. See how it attacks and how to defend. Open Threat group APT1 Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms. Open Threat group APT34 MITRE ATT&CK describes OilRig, also tracked as APT34, as a suspected Iranian group working on behalf of the Iranian government since at least 2014, and the UAE Cyber Security Council issued advisories on it in October and December 2024. MITRE and the UAE council list government, energy, financial, chemical and telecoms targets mainly in the Middle East, reached through phishing emails and stolen logins. Open

Browse The Library.