Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Wireshark Tutorial: Decrypting RDP Traffic

Summary: Unit 42 published a tutorial showing how to decrypt Remote Desktop Protocol traffic in Wireshark by building a two-host Windows 10 lab, removing forward secrecy ciphers (ECDHE and ECDSA entries) from the RDP client's SSL Cipher Suite Order via Group Policy, and extracting the RDP server's private key with Jailbreak or Mimikatz. The captured session ran over TCP port 3389 against server DESKTOP-USER1PC at 10.3.4.138, and loading that key into Wireshark's RSA keys list turned a blank RDP filter into readable results.

Why it matters: RDP has been a significant ransomware attack vector since 2017, and the same encryption that hides attacker activity from signature writers also hides it from defenders - this tutorial shows the key extraction needed to see inside that traffic.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related