T1021.001 — Remote Desktop Protocol

Tactic: Lateral Movement · Platforms: Windows

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop…

Sub-technique of Remote Services (T1021).

Sigma detection rules (1)

T1021.001 Remote Services: Remote Desktop Protocol - Interactive RDP Logon

title: "T1021.001 Remote Services: Remote Desktop Protocol - Interactive RDP Logon"
id: a80f02fb-7010-4435-9b09-98c745196f92
status: test
description: 'Detects a successful interactive logon over RDP (LogonType 10), or an RDP session reconnect/disconnect event — the core account-activity signal for this technique.'
references:
  - https://attack.mitre.org/techniques/T1021/001/
author: Shahrukh Khan
date: 2026-07-10
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1021.001

logsource:
  product: windows
  service: security

detection:
  selection_logon:
    EventID: 4624
    LogonType: 10

  selection_session:
    EventID:
      - 4778
      - 4779

  condition: selection_logon or selection_session

falsepositives:
  - Legitimate RDP-based remote administration — tune to unexpected accounts, hosts, or off-hours activity

level: medium

Related sub-techniques

Explore