Exposed RDP Remains an Easy Entry Point for Attackers, Huntress Says
Summary
Huntress describes three intrusions involving exposed RDP or attackers enabling it, and recommends firewall restrictions, closing exposed access, rotating credentials, and monitoring firewall and VPN logs with SIEM and EDR.
Key points
- Internet-wide scanning can find exposed RDP, commonly using port 3389, and give attackers an entry point without sophisticated exploits.
- A healthcare organization’s exposed RDP server was accessed; SIEM detected the intrusion, and the SOC removed the attacker before persistence.
- Attackers returned through the same exposed RDWeb portal the next day using a different compromised account because the entry point remained open.
- In another case, an attacker who entered through a SonicWall VPN enabled RDP and moved laterally; EDR detected the activity before a foothold was established.
- Huntress recommends putting RDP behind a firewall, closing exposed entry points promptly, and rotating associated credentials.
- The article also recommends ingesting firewall and VPN logs into SIEM alongside EDR to improve visibility beyond endpoints.
Article Details
- Defense Focus
- Detect and contain opportunistic intrusions through exposed RDP/RDWeb, and reduce risk by closing exposed access paths and improving security visibility.
- Detection Methods
- Use SIEM to detect initial access through exposed RDP or RDWeb.
- Use EDR to detect lateral movement before an attacker establishes a foothold.
- Conduct an external scan of the organization's IP space to identify exposed ports and services; the article also mentions Shodan as an option.
- Monitor for changes that enable RDP, including registry and firewall rule modifications, and authentication from a known malicious workstation.
- Data Sources
- Firewall and VPN logs ingested into SIEM
- Endpoint telemetry, including lateral movement, registry changes, firewall rule changes, and authentication events
- External scan results for exposed ports and services
- Platforms
- SIEM
- EDR
- Defensive Actions
- Place RDP behind a firewall and close exposed RDP/RDWeb access paths.
- After an intrusion through an exposed access point, close that exposure and rotate associated credentials.
- Ingest firewall and VPN logs into SIEM to improve visibility beyond endpoints.
- Use EDR to detect and contain lateral movement.
- Regularly scan the organization's external IP space for exposed ports and services.
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryAfter enabling RDP, the attacker used Advanced IP Scanner for network enumeration.T1021 · Remote ServicesThe article describes repeated remote access through exposed RDP/RDWeb entry points.T1021.001 · Remote Desktop ProtocolThe article describes attackers using RDP for remote access, including enabling RDP by changing registry settings and firewall rules.T1021.002 · SMB/Windows Admin SharesIn one incident, the attacker entered the partner network through a vulnerable SonicWall VPN.T1059.003 · Windows Command ShellThe attacker used Windows command-line commands to change registry and firewall settings and restart the Remote Desktop service.T1090 · ProxyIn the RDWeb incident, attackers brought a custom-built reverse tunnel for persistent access.T1110 · Brute ForceA related example in the article describes an intrusion chain involving brute-forced RDP.T1110.003 · Password SprayingThe RDWeb incident involved automated credential-harvesting scripts, but the article does not specify password spraying; omitted.T1110.004 · Credential StuffingThe article specifically refers to brute-forced RDP in the related “From RDP to Beacon” example.T1133 · External Remote ServicesAttackers accessed environments through internet-exposed RDP and an exposed RDWeb portal.
People
Vendors
Freakhostingnetwork through a vulnerable SonicWall VPN, using cheap $10 hosting infrastructure (Hostinger and Freakhosting) as a launchpad. Once inside, the attacker moved laterally and modified the firewall and registryHostingera partner's network through a vulnerable SonicWall VPN, using cheap $10 hosting infrastructure (Hostinger and Freakhosting) as a launchpad. Once inside, the attacker moved laterally and modified the firewallHuntressAccording to a recent Huntress survey of 1,050 IT and security professionals, the most common security team sizes fall between 6–10 people (21.4%) and 11–15 people (19%). More telling: only 39.6% of organizations have aSonicWallOur SOC caught a cybercriminal who compromised a partner's network through a vulnerable SonicWall VPN, using cheap $10 hosting infrastructure (Hostinger and Freakhosting) as a launchpad. Once inside, the attacker moved
Products
Linuxincident, the attackers brought a custom-built reverse tunnel for persistent access, with Windows and Linux builds, and automated credential-harvesting scripts running in the background.Microsoft WindowsIn this incident, the attackers brought a custom-built reverse tunnel for persistent access, with Windows and Linux builds, and automated credential-harvesting scripts running in the background.Remote Desktop Web Access (RDWeb)In another case, a threat actor accessed a client environment through an exposed Remote Desktop Web Access (RDWeb) portal. RDWeb is a Microsoft component that uses RDP technology for users to securely access internal
Tools
Advanced IP ScannerThis was followed by authentication from a known malicious workstation and Advanced IP scanner for more enumeration.Shodana firewall. If you don't know whether RDP is exposed on your network, look into it today. Tools like Shodan or a basic external scan of your IP space will help. That's your starting point.