T1021.001

Official Description

Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services)

Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the [Accessibility Features](https://attack.mitre.org/techniques/T1546/008) or [Terminal Services DLL](https://attack.mitre.org/techniques/T1505/005) for Persistence.(Citation: Alperovitch Malware)

Tactics: Lateral Movement
Platforms: Windows
Parent Technique: T1021 · Remote Services
MITRE Version: 1.4
Last Modified: May 12, 2026

View on MITRE ATT&CK ↗

Reported Context (2)

Threat actors accessed the domain controller through an RDP session. PaperCut Zero-Days Used to Deploy AdaptixC2 and Compromise an Education Customer’s Domain
Attackers use RDP for remote access after enabling it on compromised machines. A Playbook for Hardening Remote Access Tools in SMBs

CVE (5)

Malware (3)

Threat Actors (1)

MITRE ATT&CK (25)

Vendors (4)

Products (14)

Tools (9)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.