My Courses

What is RDP, why is it a very nearly ubiquitous finding in incident response, and how can investigators run it to ground it when it goes wrong? An Active Adversary Special Report

Is it really that risky to expose an RDP port to the internet? What if you change the default port? What if it’s just for a little while? The data answers, loud and clear

How can defenders begin to make sense of RDP issues on their networks? We present three powerful tools for investigators’ toolkits

Where in the world is your attacker? Presenting a less-known but useful event to look for in your logs

Keeping an eye on who’s trying to get onto your network – whether or not they’re successful – can pay off on multiple fronts