Analytics BIOC Medium

RDP Connection to localhost

An RDP connection to localhost can be used for privilege escalation by leveraging Windows accessibility features.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Lateral Movement (TA0008)
ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001)
Detector tags: Enhanced RDP Analytics
Attacker's goals:

An attacker may initiate RDP tunneling for a more convenient and stable interface.

Investigative actions:

Identify the process/user performing RDP and check that it is authorized. Check whether the initiating process also connects to an external host.

Test period:
N/A (single event)
Deduplication:
1 Hour