Esc
Remote Desktop Protocol - T1021.001

(ATT&CK® Technique)
Definition

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.
        graph LR;

     T1021001["Remote Desktop Protocol"] --> |produces| AdministrativeNetworkTraffic["Administrative Network Traffic"]; class T1021001 OffensiveTechniqueNode;
        class AdministrativeNetworkTraffic ArtifactNode; click AdministrativeNetworkTraffic href "/dao/artifact/d3f:AdministrativeNetworkTraffic";
        click T1021001 href "/offensive-technique/attack/T1021.001/"; click AdministrativeNetworkTraffic href "/dao/artifact/d3f:AdministrativeNetworkTraffic"; T1021001["Remote Desktop Protocol"] --> |creates| RDPSession["RDP Session"]; class T1021001 OffensiveTechniqueNode;
        class RDPSession ArtifactNode; click RDPSession href "/dao/artifact/d3f:RDPSession";
        click T1021001 href "/offensive-technique/attack/T1021.001/"; click RDPSession href "/dao/artifact/d3f:RDPSession";             T1021001["Remote Desktop Protocol"] --> |produces| IntranetNetworkTraffic["Intranet Network Traffic"]; class T1021001 OffensiveTechniqueNode;
        class IntranetNetworkTraffic ArtifactNode; click IntranetNetworkTraffic href "/dao/artifact/d3f:IntranetNetworkTraffic";
        click T1021001 href "/offensive-technique/attack/T1021.001/"; click IntranetNetworkTraffic href "/dao/artifact/d3f:IntranetNetworkTraffic";              PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -->
          | analyzes | AdministrativeNetworkTraffic["Administrative Network Traffic"];

          PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -.->
            | May Detect | T1021001["Remote Desktop Protocol"] ;
          class PerHostDownload-UploadRatioAnalysis DefensiveTechniqueNode;
          class AdministrativeNetworkTraffic ArtifactNode;
          click PerHostDownload-UploadRatioAnalysis href "/technique/d3f:PerHostDownload-UploadRatioAnalysis"; ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -->
          | analyzes | AdministrativeNetworkTraffic["Administrative Network Traffic"];

          ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -.->
            | May Detect | T1021001["Remote Desktop Protocol"] ;
          class ProtocolMetadataAnomalyDetection DefensiveTechniqueNode;
          class AdministrativeNetworkTraffic ArtifactNode;
          click ProtocolMetadataAnomalyDetection href "/technique/d3f:ProtocolMetadataAnomalyDetection"; RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -->
          | analyzes | AdministrativeNetworkTraffic["Administrative Network Traffic"];

          RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -.->
            | May Detect | T1021001["Remote Desktop Protocol"] ;
          class RemoteTerminalSessionDetection DefensiveTechniqueNode;
          class AdministrativeNetworkTraffic ArtifactNode;
          click RemoteTerminalSessionDetection href "/technique/d3f:RemoteTerminalSessionDetection"; Client-serverPayloadProfiling["Client-server Payload Profiling"] -->
          | analyzes | AdministrativeNetworkTraffic["Administrative Network Traffic"];

          Client-serverPayloadProfiling["Client-server Payload Profiling"] -.->
            | May Detect | T1021001["Remote Desktop Protocol"] ;
          class Client-serverPayloadProfiling DefensiveTechniqueNode;
          class AdministrativeNetworkTraffic ArtifactNode;
          click Client-serverPayloadProfiling href "/technique/d3f:Client-serverPayloadProfiling";                         NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -->
          | analyzes | IntranetNetworkTraffic["Intranet Network Traffic"];

          NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -.->
            | May Detect | T1021001["Remote Desktop Protocol"] ;
          class NetworkTrafficCommunityDeviation DefensiveTechniqueNode;
          class IntranetNetworkTraffic ArtifactNode;
          click NetworkTrafficCommunityDeviation href "/technique/d3f:NetworkTrafficCommunityDeviation";  PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -->
          | analyzes | IntranetNetworkTraffic["Intranet Network Traffic"];

          
          class PerHostDownload-UploadRatioAnalysis DefensiveTechniqueNode;
          class IntranetNetworkTraffic ArtifactNode;
          click PerHostDownload-UploadRatioAnalysis href "/technique/d3f:PerHostDownload-UploadRatioAnalysis";  ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -->
          | analyzes | IntranetNetworkTraffic["Intranet Network Traffic"];

          
          class ProtocolMetadataAnomalyDetection DefensiveTechniqueNode;
          class IntranetNetworkTraffic ArtifactNode;
          click ProtocolMetadataAnomalyDetection href "/technique/d3f:ProtocolMetadataAnomalyDetection";  RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -->
          | analyzes | IntranetNetworkTraffic["Intranet Network Traffic"];

          
          class RemoteTerminalSessionDetection DefensiveTechniqueNode;
          class IntranetNetworkTraffic ArtifactNode;
          click RemoteTerminalSessionDetection href "/technique/d3f:RemoteTerminalSessionDetection";  Client-serverPayloadProfiling["Client-server Payload Profiling"] -->
          | analyzes | IntranetNetworkTraffic["Intranet Network Traffic"];

          
          class Client-serverPayloadProfiling DefensiveTechniqueNode;
          class IntranetNetworkTraffic ArtifactNode;
          click Client-serverPayloadProfiling href "/technique/d3f:Client-serverPayloadProfiling";             NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -->
          | analyzes | AdministrativeNetworkTraffic["Administrative Network Traffic"];

          
          class NetworkTrafficCommunityDeviation DefensiveTechniqueNode;
          class AdministrativeNetworkTraffic ArtifactNode;
          click NetworkTrafficCommunityDeviation href "/technique/d3f:NetworkTrafficCommunityDeviation";               UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -->
          | analyzes | AdministrativeNetworkTraffic["Administrative Network Traffic"];

          UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -.->
            | May Detect | T1021001["Remote Desktop Protocol"] ;
          class UserGeolocationLogonPatternAnalysis DefensiveTechniqueNode;
          class AdministrativeNetworkTraffic ArtifactNode;
          click UserGeolocationLogonPatternAnalysis href "/technique/d3f:UserGeolocationLogonPatternAnalysis"; SessionTermination["Session Termination"] -->
          | deletes | RDPSession["RDP Session"];

          SessionTermination["Session Termination"] -.->
            | May Evict | T1021001["Remote Desktop Protocol"] ;
          class SessionTermination DefensiveTechniqueNode;
          class RDPSession ArtifactNode;
          click SessionTermination href "/technique/d3f:SessionTermination"; NetworkTrafficFiltering["Network Traffic Filtering"] -->
          | filters | AdministrativeNetworkTraffic["Administrative Network Traffic"];

          NetworkTrafficFiltering["Network Traffic Filtering"] -.->
            | May Isolate | T1021001["Remote Desktop Protocol"] ;
          class NetworkTrafficFiltering DefensiveTechniqueNode;
          class AdministrativeNetworkTraffic ArtifactNode;
          click NetworkTrafficFiltering href "/technique/d3f:NetworkTrafficFiltering";                   UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -->
          | analyzes | IntranetNetworkTraffic["Intranet Network Traffic"];

          
          class UserGeolocationLogonPatternAnalysis DefensiveTechniqueNode;
          class IntranetNetworkTraffic ArtifactNode;
          click UserGeolocationLogonPatternAnalysis href "/technique/d3f:UserGeolocationLogonPatternAnalysis";    NetworkTrafficFiltering["Network Traffic Filtering"] -->
          | filters | IntranetNetworkTraffic["Intranet Network Traffic"];

          
          class NetworkTrafficFiltering DefensiveTechniqueNode;
          class IntranetNetworkTraffic ArtifactNode;
          click NetworkTrafficFiltering href "/technique/d3f:NetworkTrafficFiltering";                    NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -->
          | analyzes | AdministrativeNetworkTraffic["Administrative Network Traffic"];

          NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -.->
            | May Detect | T1021001["Remote Desktop Protocol"] ;
          class NetworkTrafficSignatureAnalysis DefensiveTechniqueNode;
          class AdministrativeNetworkTraffic ArtifactNode;
          click NetworkTrafficSignatureAnalysis href "/technique/d3f:NetworkTrafficSignatureAnalysis";             ConnectionAttemptAnalysis["Connection Attempt Analysis"] -->
          | analyzes | IntranetNetworkTraffic["Intranet Network Traffic"];

          ConnectionAttemptAnalysis["Connection Attempt Analysis"] -.->
            | May Detect | T1021001["Remote Desktop Protocol"] ;
          class ConnectionAttemptAnalysis DefensiveTechniqueNode;
          class IntranetNetworkTraffic ArtifactNode;
          click ConnectionAttemptAnalysis href "/technique/d3f:ConnectionAttemptAnalysis";  NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -->
          | analyzes | IntranetNetworkTraffic["Intranet Network Traffic"];

          
          class NetworkTrafficSignatureAnalysis DefensiveTechniqueNode;
          class IntranetNetworkTraffic ArtifactNode;
          click NetworkTrafficSignatureAnalysis href "/technique/d3f:NetworkTrafficSignatureAnalysis";
json