Remote Desktop Protocol

Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft to enable remote connections to other computers.

 What’s important to know about RDP is that it is “interactive” meaning you can have a full visual desktop session on a remote computer as opposed to “non-interactive” sessions in which you only get a hacker looking text-based command prompt. Interactivity is significant to Plurilock because DEFEND only works in interactive sessions. This is a significant limitation because hackers almost exclusively use non-interactive sessions. The interactivity limitation does not need to be a show stopped however. For legitimate uses, non-interactive sessions should always be tied back to an interactive session. DEFEND is really good at verifying that the user at the origin interactive session is the right person. If you have that piece of information, you can infer which non-interactive sessions are bad, which is incredibly hard to do otherwise.