RDP

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP) to expand access and perform actions as the logged-on user. Direct Internet-originating access is possible only when the target's configured RDP listener is exposed and reachable from the client; a tunneled path instead requires an accessible SSH gateway that can reach the target listener.