I Watched You Roll the Die: Unparalleled RDP Monitoring Reveal Attackers' Tradecraft
summary
An RDP interception platform called PyRDP records screen, mouse, keyboard, clipboard and file transfers from cloud honeynets run for three years and produces 190 million events, 100+ hours of video, ~2,300 session captures and hundreds of recovered files; analysts crack 3 million NTLMv2 hashes and attribute ~95 actor clusters. The system includes a player to replay sessions, exposes persistent tricks like the ghost user and active tools observed include NLBrute and Masscan GUI, and the deployment and logs pipeline prove scalable and operational.
AI-written summary · about
chapters (10)
- 0:00RDP monitoring research intro
- 3:55PyRDP tool capabilities
- 6:43RDP honeypot setup
- 9:55Attackers' D&D profiles
- 19:08Attackers' tools analysis
- 29:26Attacker behavior observations
- 32:36Research infrastructure replication
- 34:02Key takeaways
- 36:53Call to action
- 38:18Open-source tools
related talks
43mHuman Involvement Behind Remote Desktop Protocol Brute-Force Attacks
49mHe Said, She Said – Poisoned RDP Offense and Defense
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
17mRadRAT: An all-in-one toolkit for complex espionage ops
39mFuzzing and Exploiting Virtual Channels in Microsoft Remote Desktop Protocol for Fun and Profit
52mStart covering your bases & Stop chasing APT headlines
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home