Beyond the IP: Identifying Compromised Identities in RDP Sessions

This research article argues defenders should look beyond network-layer indicators (like IPs) and baseline RDP client artifacts—keyboard layout, display resolution, timezone, and OS type—to identify compromised identities and RDP-based hopping. It explains how application-layer metadata is often conveyed unchanged through VPNs or proxies, outlines common attacker obfuscation methods, and provides four practical anomaly-based hunting techniques (locale mismatches, impossible hardware/display resolutions, unexpected clients, and timezone anomalies) to surface unauthorized RDP access.