T1021.001 Remote Desktop Protocol — Attack Simulation

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Disable NLA for RDP via Command Prompt
windows automated command_prompt
Procedure 01d1c6c0-faf0-408e-b368-752a02285cb2; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Changing RDP Port to Non Standard Port via Powershell
windows automated powershell
Procedure 2f840dd4-8a2e-4f44-beb3-6b2399ea3771; elevation required; cleanup present, not reviewed. Not executed or individually validated.
RDP to Remote Host
windows automated powershell
Procedure 355d4632-8cb9-449d-91ce-b566d0253d3e; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Changing RDP Port to Non Standard Port via Command_Prompt
windows automated command_prompt
Procedure 74ace21e-a31c-4f7d-b540-53e4eb6d1f73; elevation required; cleanup present, not reviewed. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint onprem Windows lateral-movement isolated_authorized_lab procedure_review_required telemetry_configuration_required some_candidates_require_elevation

can_simulate subtechnique source_mapped

Detection and collection

T1021.001 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.