Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1021.001sub-technique of T1021 Remote Services

Remote Desktop Protocol

Windows4 pieces on this siteT1021.001 on attack.mitre.org

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

1

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Cloud account compromise

Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.

The evidence it leaves

1

Where the traces live, and what each source proves and does not.

Practise it

1

Labs, timelines, evidence packs and tabletop scenarios to work before you need to.

Guided labMembersCONSTRUCTED

Guided lab: nine hours at Northwind Freight, from lure to scheduled task

A constructed intrusion written as a DFIR report. You get the same artifacts an analyst gets on day one, in the order they arrive, and you build the timeline yourself. The company is fictional; the techniques, event IDs and analytic reasoning are not.

T1021.001

Read

2

Analyses, case studies, guides, references and interview questions.

AnalysisCONSTRUCTED

Evidence Gap Challenge No. 3: four people knew that password

An operational technology jump host, a shared engineering account, and a change nobody will own. Every log works, every timestamp is right, and attribution is still impossible. Work out what that costs, and what you would have needed to collect to make a name provable.

T1021.001
ReferenceCONSTRUCTED

Windows event log cheat sheet: by the question you are asking

Organised by what you are trying to establish rather than by number: who logged on and how, what ran, what persisted, what was tampered with. Every entry says which log, whether it is on by default, and what it does not tell you.

T1021.001

how MITRE says to see it

Multi-event Detection Strategy for RDP-Based Remote Logins and Post-Access Activity

  • Remote Desktop (RDP) logon by a user followed by unusual process execution, file access, or lateral movement activity within a short timeframe.

what reduces it

  • M1035 Limit Access to Resource Over Network. Use remote desktop gateways.
  • M1028 Operating System Configuration. Change GPOs to define shorter timeouts sessions and maximum amount of time any single session can be active. Change GPOs to specify the maximum amount of time that a disconnected session stays active on the RD session host server.
  • M1030 Network Segmentation. Do not leave RDP accessible from the internet. Enable firewall rules to block RDP traffic between network security zones within a network.
  • M1018 User Account Management. Limit remote user permissions if remote access is necessary.
  • M1026 Privileged Account Management. Consider removing the local Administrators group from the list of groups allowed to log in through RDP.
  • M1032 Multi-factor Authentication. Use multi-factor authentication for remote logins.

the rest of T1021

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.