Remote Desktop Protocol: The Series
Remote Desktop Protocol (RDP) was developed by Microsoft to allow users, administrators, and others to connect to remote computers over...
Incident response tools
Remote Desktop Protocol: Exposed RDP (is dangerous)
Is it honestly so bad to expose a server with RDP to the internet? In order to find out, we...
Remote Desktop Protocol: Queries for Investigation
Since investigators see so many RDP artifacts in the course of incident responses, they’ve naturally evolved a few favorite tools...
Remote Desktop Protocol: How to Use Time Zone Bias
Most defenders are familiar with how to find and look for suspicious RDP lateral movement, whether that means looking based...
Remote Desktop Protocol: Executing the 4624_4625 Login Query
The 4624_4625 login events query provides defenders, specifically analysts, with a useful tool for both identifying successful RDP logins (Windows...
