Re: RDPThief Tool

[Jonathon Poling <jonathon.poling () GMAIL COM>]

For the Blue Team'ers that will be investigating RDP-related incidents, I
authored (and maintain) a blog post on "Windows RDP-Related Event Logs:
Identification, Tracking, and Investigation" where I compiled and explain
the relevance of the most important RDP-related Windows Event IDs for use
in speedier investigations of RDP incidents. I've spent a lot of my career
doing IR, focusing a lot on Windows Event Logs, and couldn't find a single
source to help with RDP investigations - so I built it.

Hope it helps fellow defenders.

https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/

JP

On Thu, Nov 14, 2019 at 7:01 AM randy <marchany () vt edu> wrote:

> RDPThief steals cleartext credentials from RDP clients.  See an
> excellent writeup on the tool at
> https://www.mdsec.co.uk/2019/11/rdpthief-extracting-clear-text-credentials-from-remote-desktop-clients/
> .
>
> You can download the tool from the link at the end of the article. They
> have a nice video that shows the tool in action.  If you use RDP to/from
> any domain joined computer, you run the risk of exposing your domain
> credentials.
>
> Just an FYI.
>
> -Randy Marchany
> VA Tech IT Security Office and Lab
>
> **********
> Replies to EDUCAUSE Community Group emails are sent to the entire
> community list. If you want to reply only to the person who sent the
> message, copy and paste their email address and forward the email reply.
> Additional participation and subscription information can be found at
> https://www.educause.edu/community

**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at https://www.educause.edu/community