Procedure examples

reGeorg can be used to tunnel RDP connections.

DarkComet can open an active screen of the victim’s machine and take control of the mouse and keyboard.

zwShell has used RDP for lateral movement.

Carbanak enables concurrent Remote Desktop Protocol (RDP) sessions.

SDBbot has the ability to use RDP to connect to victim's machines.

Pysa has laterally moved using RDP connections.

Cobalt Strike can start a VNC-based remote desktop server and tunnel the connection through the already established C2 channel.

ServHelper has commands for adding a remote desktop user and sending RDP traffic to the attacker through a reverse SSH tunnel.

Revenge RAT has a plugin to perform RDP access.

ZxShell has remote desktop functionality.

njRAT has a module for performing remote desktop access.

jRAT can support RDP control.

WarzoneRAT has the ability to control an infected PC using RDP.

Imminent Monitor has a module for performing remote desktop access.

Koadic can enable remote desktop on the victim's machine.

Pupy can enable/disable RDP connection and can start a remote desktop session using a browser web socket client.

QuasarRAT has a module for performing remote desktop access.