Microsoft Adds Windows Protections for Malicious Remote Desktop Files

Microsoft Adds Windows Protections for Malicious Remote Desktop Files

1. Context and Threat Landscape

• Remote Desktop Protocol (RDP) files are widely used in enterprise environments to streamline connections to remote systems.
• Attackers have increasingly weaponized RDP files in phishing campaigns, leveraging their ability to redirect local resources to attacker-controlled hosts.
• Historical examples include rogue RDP files used by state-sponsored groups to access victims’ data and credentials.

1. What an RDP File Does

• RDP files can configure automatic redirection of local drives, printers, and other resources to the remote host.
• When opened, these files may cause a silent connection to a remote server under the attacker’s control.
• This connection can enable the attacker to access files stored on disk, capture clipboard content (including passwords or sensitive text), and redirect authentication mechanisms such as smart cards or Windows Hello.

1. Abuse Scenarios in Phishing Campaigns

• Phishing emails distribute malicious RDP files that prompt a user to open them, initiating a remote connection without explicit user consent.
• Once connected, local resources are redirected to the attacker’s system, increasing the risk of data exfiltration.
• The threat is heightened by potential credential harvesting and the possibility of bypassing certain authentication steps through redirected devices or tokens.

1. The April 2026 Protections Rollout

• New protections were introduced as part of the April 2026 cumulative updates for Windows 10 (KB5082200) and Windows 11 (KB5083769 and KB5082052).
• The goal is to prevent malicious RDP files from automatically establishing connections and exposing local resources to attackers.
• Key change: enhanced warnings and more explicit controls before any RDP connection is made.

1. How the New Warnings Work

• On first opening an RDP file after the update, a one-time educational prompt appears explaining what RDP files are and outlining the associated risks.
• After acknowledging the prompt, future attempts to open RDP files will trigger a security dialog before any connection occurs.
• The security dialog provides details about the RDP file, including:
• Whether the file is digitally signed and by whom
• The remote system’s address
• A list of local resources that could be redirected (drives, clipboard, devices), with all options disabled by default
• If an RDP file is not digitally signed, Windows shows a warning labeled “Caution: Unknown remote connection” and marks the publisher as unknown.
• If the file is digitally signed, Windows displays the publisher but still advises verifying legitimacy before connecting.

1. Signed vs Unknown Publishers

• Unknown publishers: The system clearly flags the file as unverified and disturbs the path to a connection.
• Verified publishers: The publisher’s name is shown, but the user is still prompted to assess the file’s legitimacy before proceeding.

1. Scope and Limitations

• The protections apply to connections initiated by opening RDP files, not to connections made directly through the Windows Remote Desktop client.
• The safeguards focus on the RDP file launch process and do not affect standard RDP client behavior initiated by other means.

1. Admin Controls and Temporary Overrides

• Administrators can temporarily disable these protections by editing the registry:
• Path: HKLMSoftwarePoliciesMicrosoftWindows NTTerminal ServicesClient
• Value: RedirectionWarningDialogVersion
• Set the value to 1 to disable the warning dialog behavior
• This option provides a controlled way to bypass the protections in specific environments, though use of the override is not a default setting.

1. Practical Takeaways

• The updates emphasize warnings and user awareness before any RDP-based remote access is established.
• The system now communicates clearly about the origin and potential risks of RDP files, including the status of digital signatures and the scope of resource redirections.
• The protections specifically target the scenario where a user opens an RDP file, leaving other RDP client pathways unaffected.