Protocol
protocol:remote_desktop_protocol
Also: RDP
Remote access protocol used in an unauthorized session on an operations-room computer.
Remote access protocol used in an unauthorized session on an operations-room computer.
“they found this computer had an unauthorized RDP session opened on it.”
Remote-access protocol used to expose newly created server accounts to the internet.
“give it RDP access from the internet”
Protocol whose credentials are described as being sold for initial network access.
“you can buy RDP credentials”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | INVOLVES | Triton | Explicit | 68 |
| incoming | USES | Marq | Explicit | 108 |
| incoming | USES | REvil | Explicit | 126 |
Triton INVOLVES Remote Desktop Protocol
An unauthorized RDP session was found on the operations-room computer that pushed configurations to the safety systems.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“they found this computer had an unauthorized RDP session opened on it”
Marq USES Remote Desktop Protocol
Marq planned to create accounts with internet-accessible RDP credentials on additional servers so he could sell access to them.
Explicit Confidence 98% · Jack Rhysider EP 108 Details
“he would make a new user account and give it RDP access from the internet so he could sell that username and password”
REvil USES Remote Desktop Protocol
Will says attackers could buy RDP credentials as an entry point for REvil attacks.
Explicit Confidence 97% · Will EP 126 Details
“you can buy RDP credentials”