Jigsaw RDPuzzle: Piecing Attacker Actions Together

Wed, 29 Jan 2025 00:00:00 +0000

In a recent incident response project, we had the chance to virtually look over the attackers’ shoulder and observe their activities. The attackers used the Remote Desktop Protocol (RDP) for lateral movement within the compromized environment and beyond (MITRE techniques T1570, T1021). As a matter of fact, RDP creates cache files that contain tiles of the transferred screen recording data. While this fact is well-known and there are existing tools, we found it worth reporting because of two different aspects:

Incident Response on Insinuator.net - Bold Statements

Jigsaw RDPuzzle: Piecing Attacker Actions Together