Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Lateral Movement/ T1021.001

T1021.001Remote Desktop Protocol

T1021.001 — Remote Desktop Protocol is a MITRE ATT&CK technique in the Lateral Movement tactic. Clankerusecase tracks 21 detection use cases covering it and 50 threat-intel articles citing it.

Lateral Movement
View on the matrix → Filter Detection Library MITRE official spec ↗
21Use cases
50Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1021 · Remote Services

Use cases covering this technique (21)

Allow Inbound Traffic By Firewall Rule Registry ESCU actions · alerting P Allow Inbound Traffic In Firewall Rule ESCU actions · alerting P Remote Desktop Process Running On System ESCU actions · hunting P Windows Default RDP File Creation By Non MSTSC Process ESCU actions · hunting P Windows Default Rdp File Unhidden ESCU actions · hunting P Windows MSTSC RDP Commandline ESCU actions · hunting P Windows Process Execution From RDP Share ESCU actions · hunting P Windows RDP Bitmap Cache File Creation ESCU actions · hunting P Windows RDP Client Launched with Admin Session ESCU actions · hunting P Windows RDP File Execution ESCU actions · alerting P Windows RDP Login Session Was Established ESCU actions · hunting P Windows RDP Server Registry Entry Created ESCU actions · hunting P Windows Remote Service Rdpwinst Tool Execution ESCU actions · alerting P Windows Remote Services Allow Rdp In Firewall ESCU actions · hunting P Windows Remote Services Allow Remote Assistance ESCU actions · hunting P Windows Remote Services Rdp Enable ESCU actions · alerting P Remote Desktop Network Traffic ESCU actions · hunting P Windows Default RDP File Creation ESCU actions · hunting P [LLM] OkoBot 'Apple Sync' scheduled task maintaining reverse SSH tunnel forwarding RDP Bespoke install · alerting DSΣPDDCS [LLM] OkoBot termsrv.dll patch enabling concurrent RDP sessions Bespoke install · alerting DSΣPDDCS [LLM] OkoBot RDP back-connection: local RDP user creation + firewall opening Bespoke install · hunting DSΣPDDCS

Articles citing this technique (50)

crit Toy Ghouls’ new toy: the GenieLocker ransomware art-05
high Four incident-response decisions from the Hugging Face breach art-12
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-58
high Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable art-79
crit Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available art-80
high Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git art-81
crit CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking art-82
crit Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE art-83
crit DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts art-84
crit BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery art-104
crit Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller art-105
high ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link art-107
crit Don’t swing at everything art-110
high Finding eight high-severity vulnerabilities in NodeBB in six hours art-119
high SQL injection isn't dead art-122
high A new extortion cocktail: office printers, small ransoms, and BitLocker art-134
crit CISA KEV: CVE-2026-60137 — WordPress Core SQL Injection Vulnerability art-137
crit SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts art-145
crit Unauthenticated RCE in WordPress core (wp2shell), via SQL injection art-146
crit TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development art-172
crit OkoBot: new sophisticated malware framework targets cryptocurrency users art-173
high How Aikido Intel detects malware and vulnerabilities first art-193
crit No Manners Here: The Ruthless Rise of The Gentlemen Ransomware art-202
crit Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation art-227
high How We Added WebAuthn to a Browser-Based RDP Client art-254
crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-302
high Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer art-400
crit Webworm: New burrowing techniques art-413
crit PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale art-446
crit CISA KEV: CVE-2026-41940 — WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability art-467
high As breakout time accelerates, prevention-first cybersecurity takes center stage art-530
crit CISA KEV: CVE-2025-5777 — Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability art-905
crit CISA KEV: CVE-2025-6543 — Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability art-915
high What you should know about PHP code security art-1235
crit CISA KEV: CVE-2023-6549 — Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability art-1425
crit CISA KEV: CVE-2023-4966 — Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability art-1531
crit CISA KEV: CVE-2023-36563 — Microsoft WordPad Information Disclosure Vulnerability art-1542
med Security implications of HTTP response headers art-1743
crit API Security Guide art-1751
crit Key points from Google and Accenture's ransomware white paper art-1935
high Snyk finds PyPi malware that steals Discord and Roblox credential and payment info art-2072
crit CISA KEV: CVE-2019-0708 — Microsoft Remote Desktop Services Remote Code Execution Vulnerability art-2926
crit CISA KEV: CVE-2017-0199 — Microsoft Office and WordPad Remote Code Execution Vulnerability art-2953
crit CISA KEV: CVE-2020-25213 — WordPress File Manager Plugin Remote Code Execution Vulnerability art-3048
crit CISA KEV: CVE-2020-11738 — WordPress Snap Creek Duplicator Plugin File Download Vulnerability art-3049
crit CISA KEV: CVE-2019-9978 — WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability art-3050
high Using third party content securely art-3459
high Scoring security vulnerabilities 101: Introducing CVSS for CVEs art-3519
high Which of the OWASP Top 10 Caused the World’s Biggest Data Breaches? art-3644
high HTTPS Adoption *doubled* this year art-3677