Remote Desktop exposure AFFECTS Remote Desktop
The vulnerability is the exposure of Remote Desktop directly to the public internet.
Explicit Confidence 99% · Jack Rhysider EP 96 Details
“accessible from the internet over Remote Desktop”
Protocol
protocol:remote_desktop
Also: RDP
Windows remote-access service exposed to the internet and targeted through scanning and password guessing.
Windows remote-access service exposed to the internet and targeted through scanning and password guessing.
“port 3389 open, or Remote Desktop”
“Windows machines have the capability to connect to them remotely”
Remote-access service used to expose the police department’s domain controller to the internet.
“this police station’s domain controller was accessible from the internet over Remote Desktop.”
“admin credentials to this server, to RDP in”
Remote login method used to place malware on the compromised server.
“someone simply logged into this computer normally, through Remote Desktop”
Remote access mechanism used to connect from one internal computer to another during network traversal.
“Eventually, Adam was able to Remote Desktop to a computer”
“there might be an RDP icon saved”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | AFFECTS | Remote Desktop exposure | Explicit | 96 |
| incoming | INVOLVES | police department ransomware incident | Explicit | 96 |
| incoming | USES | the mayor of the city | Explicit | 96 |
| incoming | USES | Cloud Hopper | Explicit | 103 |
| incoming | INITIAL_ACCESS_VIA | Cloud Hopper | Explicit | 103 |
Remote Desktop exposure AFFECTS Remote Desktop
The vulnerability is the exposure of Remote Desktop directly to the public internet.
Explicit Confidence 99% · Jack Rhysider EP 96 Details
“accessible from the internet over Remote Desktop”
police department ransomware incident INVOLVES Remote Desktop
The attacker and legitimate users accessed the domain controller through Remote Desktop.
Explicit Confidence 98% · Nicole Beckwith EP 96 Details
“admin credentials to this server, to RDP in”
the mayor of the city USES Remote Desktop
The mayor says he used Remote Desktop to access the police department server remotely to check email.
Explicit Confidence 98% · Jack Rhysider EP 96 Details
“logging into the police department’s domain server to check your e-mail”
“logging into this server through Remote Desktop”
Cloud Hopper USES Remote Desktop
The malware was placed on the server after an attacker logged in through Remote Desktop using stolen credentials.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“someone simply logged into this computer normally, through Remote Desktop, and put it there”
Cloud Hopper INITIAL_ACCESS_VIA Remote Desktop
The investigated server was initially accessed through Remote Desktop with a stolen MSP employee account.
Explicit Confidence 96% · Jack Rhysider EP 103 Details
“They logged into it and put the malware on.”