An RDP file is a Remote Desktop configuration file that stores connection parameters such as host, display and device redirection settings. Attackers use or tamper with it to redirect users to malicious hosts or weaken session controls. Defenders should inspect saved files for unexpected destinations, credential handling and risky redirection settings.
What the RDP file contains
An RDP file is more than a shortcut to a remote session, it is a stored set of instructions that can shape where the session connects, how it presents, and which local devices or resources are exposed during use. Because it encodes connection behavior, it can become a security object in its own right rather than a passive configuration artifact.
In practice, the file often holds the target host name or IP address, display preferences, redirection settings, and connection options that influence authentication and session behavior. That means a tampered file can quietly change the trust boundary before a user ever sees a remote desktop prompt.
Why tampering with an RDP file matters
When attackers alter an RDP file, they can redirect a user to a malicious endpoint, downgrade protective settings, or increase the amount of local data and input that crosses into the remote session. The danger is not limited to malware delivery, because the file can also be used to steer users into a hostile infrastructure that looks like a legitimate access path.
This is especially important in environments where remote access is routine. Users tend to trust saved connection files, so a small change in a saved destination or redirection option can create an entry point for credential capture, session abuse, or lateral movement. Remote Desktop (RDP) Security Guide covers the surrounding controls that help reduce those risks.
How organisations should evaluate exposure
The first question is whether RDP files are present anywhere in the estate and who can create, edit, distribute, or launch them. Saved files on endpoints, shared drives, help desk portals, and remote support workflows all widen exposure, especially if users download them from email, chat, or ticketing systems without validation.
Exposure review should also include the destination itself. A trusted file is still risky if it points to an internet-reachable host, a tenant outside the expected boundary, or an environment that does not enforce the organisation’s normal remote access controls. Saved connection metadata should be treated as part of the access path, not just a convenience setting.
For broader remote movement context, the Lateral Movement Guide is useful because RDP is frequently one of the paths attackers try after they have obtained valid access.
Defensive controls, detection, and post-incident review
Defence starts with validating the file before use, then checking whether its destination, redirection settings, and authentication expectations match policy. Where possible, remote desktop should be brokered through approved gateways and constrained by session controls so that a standalone file cannot silently redefine trust.
Detection should look for unusual saved destinations, odd changes to redirection flags, and repeated use of a file that was not issued by an approved source. If an RDP file was used during a compromise, reviewers should assume the session may have exposed credentials, clipboard contents, local drives, or other redirected data. Saved files should be retained as evidence because they can show how the connection was redirected or weakened.
When compromise is suspected, the review should extend beyond the file itself to the account and session material used through it. Credential hygiene, session tracing, and endpoint inspection matter because the file may simply be the delivery mechanism for a broader remote access compromise.
Risk and Threat Considerations
An RDP file creates risk because it can conceal a hostile destination or weaken the security of a remote session while appearing routine to the user. That makes it a practical phishing and lateral-movement vehicle, especially when users trust saved files more than the connection they are about to establish.
Failure mechanism: The file is modified, substituted, or delivered from an untrusted source, then the user launches it and unknowingly connects to an attacker-controlled host or an over-permissive session.
Impact: The attacker may capture credentials, redirect traffic through a malicious endpoint, observe or harvest redirected data, or use the session as a foothold for further access.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | RDP files can carry or influence credential handling and session access. |
| AC-17 — Remote Access | RDP files directly define remote desktop access paths and session conditions. | |
| CM-6 — Configuration Settings | RDP files store session configuration that can be hardened or altered. | |
| Recommendation — Apply IA-5 to control how remote access credentials are issued, stored, and reused in saved connection workflows. Enforce AC-17 for approved remote access routes, gateways, and session constraints. Use CM-6 to standardise approved remote desktop settings and block unsafe redirection options. | ||
| MITRE ATT&CK | T1021.001 — Remote Desktop Protocol | RDP files are part of the remote desktop attack path used for remote access and movement. |
| Recommendation — Map observed RDP use to T1021.001 and hunt for suspicious remote desktop connections and abuse. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | RDP files affect who can reach remote systems and how access is mediated. |
| Recommendation — Use CIS-6 to restrict and review remote desktop access paths and related privileges. | ||
Practitioner Guidance
What to watch for: Treat any RDP file as a security-sensitive object if it comes from email, chat, shared storage, or a support workflow that can be tampered with. The most important judgement is whether the file’s destination and redirection behavior are expected for the user and the task.
Governance implication: Organisations should define who may issue or modify these files, how they are distributed, and what settings are acceptable before they are used. A saved connection file should not bypass the same access review that would apply to the remote desktop session itself.