Port 3389 (RDP)
Microsoft Remote Desktop Protocol.
- Transport
- TCP/UDP
- Internet exposure
- Never expose
Should not be reachable from the internet.
Security notes
- Exposed RDP is one of the most common ransomware entry points, through brute force or stolen credentials.
- BlueKeep (CVE-2019-0708) allowed unauthenticated remote code execution on older Windows versions.
- Put RDP behind a VPN or gateway with multi-factor authentication.
When it shows up in your logs
Inbound 3389 from the internet is scanning or brute forcing. Internal RDP between workstations can be lateral movement.