Remote Desktop Protocol, or RDP, is a Windows feature that lets a person open an interactive session on another computer over a network. It is useful for administration and remote work. Attackers who hold valid credentials can use it in the same way.
- Also Called3other namesRDP · remote desktop · Windows Remote Desktop
- Related Terms3linked entriesLateral movement · Credential theft
What Is Remote Desktop Protocol?
RDP lets a user log on to a remote system and work as if sitting at it. It is a Windows feature meant for legitimate remote access, such as administration.
How Do Attackers Use RDP?
MITRE lists RDP as a lateral movement technique, covered under remote services. It says adversaries can use RDP to establish interactive sessions on target systems with valid credentials. For a longer walkthrough, read RDP attacks explained. So RDP use depends on an account the attacker already holds. It may come after a login has been obtained rather than serve as the first break-in.
Which ATT&CK Techniques Involve RDP?
Four MITRE ATT&CK techniques connect to remote desktop access.
| ATT&CK ID | Technique | Link to RDP |
|---|---|---|
| T1078 | Valid Accounts | Stolen credentials can be used on remote desktop and other remote services. |
| T1133 | External Remote Services | Exposed remote access, such as VPNs and Citrix, can give entry to a network. |
| T1021.001 | Remote Desktop Protocol | An adversary logs in with a valid account and acts as that user. |
| T1563.002 | RDP Hijacking | An adversary takes over a legitimate user’s remote desktop session to move sideways. |
Why Can RDP Activity Look Normal?
Because RDP is a normal feature and the session uses a real account, the activity can look like ordinary administration. MITRE advises against leaving RDP accessible from the internet. In practice, an exposed RDP service can give attackers a place to try stolen credentials, and an internal one can help them spread across a network.
Which Settings Cut the Risk?
MITRE lists these mitigations.
- Do not leave RDP accessible from the internet.
- Disable RDP if it is not needed.
- Use multi-factor authentication for remote logins.
- Remove unnecessary accounts from the Remote Desktop Users group, and consider excluding local administrators.
- Use firewall rules between security zones and a remote desktop gateway to control access.
- Set shorter timeouts and maximum session lengths through Group Policy.
- Limit the privileges of remote users to what they need.
What Should Defenders Watch for?
MITRE suggests watching for an RDP logon by a user that is followed within a short time by unusual process execution, file access or lateral movement. Looking at what happens after the login is more useful than looking at the login alone.
Is RDP the Same as a VPN?
No. A VPN creates a protected network connection. RDP gives a remote interactive session on a particular computer. The two are often used together, but they do different jobs.
Is RDP the Same as Remote Access Software?
RDP is one kind of remote access, built into Windows. Other tools also give remote control but are separate products.
Terms Close to RDP
See also lateral movement, multi-factor authentication and credential theft.
Related Pages in the Knowledge Hub
Also Called.
- NameRDP
- Nameremote desktop
- NameWindows Remote Desktop
Questions.
-
What is Remote Desktop Protocol (RDP)?
RDP is a Windows feature that lets a person open an interactive session on another computer over a network. It is meant for legitimate remote access, such as administration and remote work.
-
How do attackers misuse RDP?
MITRE lists RDP as a lateral movement technique. Attackers who already hold valid credentials can use it to open interactive sessions on target systems, so it often comes after a login has been obtained.
-
How can I reduce the risk of RDP?
Do not leave RDP accessible from the internet, and disable it if it is not needed. Use multi-factor authentication for remote logins, a remote desktop gateway, and limit what remote users can do.
-
Is RDP the same as a VPN?
No. A VPN creates a protected network connection, while RDP gives a remote interactive session on a particular computer. The two are often used together but do different jobs.
Sources
- 1 Remote Services: Remote Desktop Protocol, Sub-technique T1021.001 - Enterprise, MITRE ATT&CK
- 2 Remote Services, Technique T1021 - Enterprise, MITRE ATT&CK
- 3 MITRE ATT&CK: T1078 Valid Accounts: remote desktop named as an access path, MITRE ATT&CK
- 4 MITRE ATT&CK: T1133 External Remote Services: external-facing remote access, MITRE ATT&CK
- 5 MITRE ATT&CK: T1563.002 RDP Hijacking: taking over a legitimate remote session, MITRE ATT&CK
In Our Research
- 1 RDP (Remote Desktop Protocol) Attacks Explained May 2026
- 2 BO Team Supply Chain Attack: How Intruders Reached a Software Vendor’s Signing Server November 2026
- 3 WinRAR CVE-2025-8088 Explained: How Gorbag Used Alternate Data Streams to Deliver BeautyStealer November 2026
- 4 Orova Ransomware Claims 17 Victims, Mostly in Singapore and Malaysia November 2026
- 5 The Gentlemen Ransomware Claims 24 Victims in One Day, Including Mato Grosso Health November 2026
- 6 Volt Typhoon advisory AA24-038A: what CISA says October 2026