Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Lateral Movement/ T1021.001

T1021.001Remote Desktop Protocol

T1021.001 — Remote Desktop Protocol is a MITRE ATT&CK technique in the Lateral Movement tactic. Clankerusecase tracks 19 detection use cases covering it and 87 threat-intel articles citing it.

Lateral Movement
View on the matrix → Filter Detection Library MITRE official spec ↗
19Use cases
87Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1021 · Remote Services

Use cases covering this technique (19)

Allow Inbound Traffic By Firewall Rule Registry ESCU actions · alerting P Allow Inbound Traffic In Firewall Rule ESCU actions · alerting P Remote Desktop Process Running On System ESCU actions · hunting P Windows Default RDP File Creation By Non MSTSC Process ESCU actions · hunting P Windows Default Rdp File Unhidden ESCU actions · hunting P Windows MSTSC RDP Commandline ESCU actions · hunting P Windows Process Execution From RDP Share ESCU actions · hunting P Windows RDP Bitmap Cache File Creation ESCU actions · hunting P Windows RDP Client Launched with Admin Session ESCU actions · hunting P Windows RDP File Execution ESCU actions · alerting P Windows RDP Login Session Was Established ESCU actions · hunting P Windows RDP Server Registry Entry Created ESCU actions · hunting P Windows Remote Service Rdpwinst Tool Execution ESCU actions · alerting P Windows Remote Services Allow Rdp In Firewall ESCU actions · hunting P Windows Remote Services Allow Remote Assistance ESCU actions · hunting P Windows Remote Services Rdp Enable ESCU actions · alerting P Remote Desktop Network Traffic ESCU actions · hunting P Windows Default RDP File Creation ESCU actions · hunting P [LLM] RDP re-enable + EDR/Defender disable batch script (LockBit intrusion) Bespoke install · alerting DSΣPDDCS

Articles citing this technique (87)

crit CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE art-03
crit Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects art-05
high Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection art-08
crit Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic art-10
crit Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access art-23
crit Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies art-25
crit Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware art-28
crit SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch art-37
crit Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner art-38
high Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware art-40
high Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth art-43
high Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers art-44
crit CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps art-45
high Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware art-46
crit China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud art-49
high GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE art-50
crit ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories art-51
crit New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure art-53
crit AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS art-55
crit WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud art-58
crit North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring art-59
crit Dissecting the JWR phishing framework art-60
crit Attackers Exploit SharePoint Authentication Bypass After Public PoC Release art-63
crit Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor art-64
high 737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One art-66
high OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning art-69
crit Enterprise Defenses Recovered at the Edge and Collapsed Inside art-70
crit Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws art-71
crit Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access art-72
crit Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations art-73
crit SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code art-74
crit ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access art-75
crit Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS art-76
high The Agent Baseline: 35 Controls, But Where Should You Start? art-77
high Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing art-79
crit Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client art-80
crit Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands art-81
high DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt art-82
crit OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development art-84
crit A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices art-85
crit Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo art-86
crit Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers art-88
high Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11 art-89
high Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets art-90
crit ChainDrop: Inside a Self-Propagating npm Worm art-108
med Who was behind the attack? Possibly nobody art-114
high The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software art-131
crit An analysis of incidents at Brazilian educational institutions art-146
crit CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft art-151
crit Anthropic's Fever Dream: Claude's package that stole real keys art-156
crit Network Anomaly Detection in KATA art-159
crit The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version art-160
high Four incident-response decisions from the Hugging Face breach art-175
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-188
crit Don’t swing at everything art-213
high Finding eight high-severity vulnerabilities in NodeBB in six hours art-222
high SQL injection isn't dead art-224
crit CISA KEV: CVE-2026-60137 — WordPress Core SQL Injection Vulnerability art-238
crit SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts art-246
crit Unauthenticated RCE in WordPress core (wp2shell), via SQL injection art-247
crit TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development art-267
high How Aikido Intel detects malware and vulnerabilities first art-284
crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-351
high Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer art-446
crit Webworm: New burrowing techniques art-459
crit PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale art-492
crit CISA KEV: CVE-2026-41940 — WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability art-512
high As breakout time accelerates, prevention-first cybersecurity takes center stage art-574
crit CISA KEV: CVE-2025-5777 — Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability art-928
crit CISA KEV: CVE-2025-6543 — Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability art-938
high What you should know about PHP code security art-1258
crit CISA KEV: CVE-2023-6549 — Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability art-1448
crit CISA KEV: CVE-2023-4966 — Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability art-1554
crit CISA KEV: CVE-2023-36563 — Microsoft WordPad Information Disclosure Vulnerability art-1565
med Security implications of HTTP response headers art-1766
crit API Security Guide art-1774
crit Key points from Google and Accenture's ransomware white paper art-1958
high Snyk finds PyPi malware that steals Discord and Roblox credential and payment info art-2095
crit CISA KEV: CVE-2019-0708 — Microsoft Remote Desktop Services Remote Code Execution Vulnerability art-2949
crit CISA KEV: CVE-2017-0199 — Microsoft Office and WordPad Remote Code Execution Vulnerability art-2976
crit CISA KEV: CVE-2020-25213 — WordPress File Manager Plugin Remote Code Execution Vulnerability art-3071
crit CISA KEV: CVE-2020-11738 — WordPress Snap Creek Duplicator Plugin File Download Vulnerability art-3072
crit CISA KEV: CVE-2019-9978 — WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability art-3073
high Using third party content securely art-3482
high Scoring security vulnerabilities 101: Introducing CVSS for CVEs art-3542
high Which of the OWASP Top 10 Caused the World’s Biggest Data Breaches? art-3667
high HTTPS Adoption *doubled* this year art-3700