{
  "port": 3389,
  "protocol": "both",
  "service": "RDP (MS WBT Server)",
  "oneLiner": "Remote Desktop — a full interactive Windows login, and one of the most attacked ports on the internet.",
  "whatItIs": "IANA calls it ms-wbt-server; everyone else calls it RDP. Windows Remote Desktop Services listens on TCP 3389 (with an optional UDP 3389 transport for graphics acceleration), speaking MS-RDPBCGR: an X.224 connection request, then a TLS or CredSSP/NLA handshake, then the graphics and input channels. It is enabled on countless Windows Server instances, Azure and EC2 VMs, and desktop machines that someone needed to reach from home. The listening port is a registry setting, so a host with RDP moved to another port often still answers the same handshake there.",
  "exposure": {
    "verdict": "never",
    "note": "Internet-facing RDP is the dominant ransomware entry vector — credential stuffing plus pre-auth bugs like BlueKeep (CVE-2019-0708). Put it behind a VPN or an RD Gateway, require NLA, and never publish 3389 directly."
  },
  "checkCommand": "nmap -Pn -p 3389 --script rdp-ntlm-info TARGET",
  "links": [
    {
      "title": "[MS-RDPBCGR]: Remote Desktop Protocol — Basic Connectivity and Graphics Remoting",
      "url": "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/5073f4ed-1e93-45e1-b039-6e30c385867c",
      "kind": "spec"
    },
    {
      "title": "Change the listening port for Remote Desktop on your computer",
      "url": "https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/change-listening-port",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 3389 (ms-wbt-server)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=3389",
      "kind": "iana"
    }
  ]
}