Analytics BIOC
Medium
✕
RDP Connection to localhost
An RDP connection to localhost can be used for privilege escalation by leveraging Windows accessibility features.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Lateral Movement (TA0008)
ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001)
Detector tags: Enhanced RDP Analytics
Attacker's goals:
An attacker may initiate RDP tunneling for a more convenient and stable interface.
Investigative actions:
Identify the process/user performing RDP and check that it is authorized. Check whether the initiating process also connects to an external host.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Hour