We have recorded RDP traffic with Wireshark as a man in the middle between these two hosts. One of the hosts was an RDP server, while the other was an RDP server. Two Windows 10 hosts were included in our test lab setup. VirtualBox or VMware Workstation for Windows and Linux are the two most common virtual environments for this sort of testing. You can download the trace file from here Virtual Environments Setup Second windows host act as an RDP Server.First windows host act as an RDP Client.A virtual environment to run Two Windows host.A good understanding of RDP Setup and Usage.Analyze Connectivity between Client & Host.Analyzing and Decrypting Wireshark Traffic.Generate and Download RDP Server’s Private Key.

Remove Encrypted Ciphers from RDP Client.

This article shows how the environment is prepared, a decryption key is obtained, and how RDP traffic can be deciphered. We can, fortunately, develop a test environment that provides the key file to decrypt the packet capture (pcap) of Wireshark’s RDP traffic. This encryption, unfortunately, makes it hard to write RDP signatures because the content of RDP is hidden. RDP supports several operating modes to encrypt network traffic, as a proprietary protocol from Microsoft. Security professionals have focused their attention increasingly on this protocol by writing signatures to detect and prevent attacks of RDP vulnerabilities.

In ransomware malware attacks since 2017, RDP has become a major vector. Over the last few years, attackers used the Remote Desktop Protocol (RDP) for accessing unsecured servers and company networks.

Deciphering wireshark captures