RAT

RdClient

RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer.

Visit tool website ↗Download JSON ↓View source YAML ↗Suggest an update ↗

Tool overview

Category: RAT
Research authors: Daniel Koifman (KoifSec)
Created: 2025-11-12
Last modified: 2025-11-12
Privileges: User
Free / availability: Yes
Verification required: Yes
Supported platforms: Windows

Capabilities

Remote Desktop AccessMultiple Protocol SupportConnection Management

Executables & installation paths

Installation paths

C:\Program Files (x86)\RdClient\*

C:\Program Files\RdClient\*

rdclient.exe

RdClientInstaller.exe

SupportTool.exe

FORENSIC EVIDENCE

Disk artifacts

File: %APPDATA%\RdClient\*
Description: Not recorded
OS: Windows

FORENSIC EVIDENCE

Registry artifacts

Path: HKLM\SOFTWARE\RdClient
Description: RdClient Installation

Detections

AQL: https://raw.githubusercontent.com/Koifman/Deathcon25/refs/heads/main/rmm_rodeo/rdclient/aql.aql
Description: QRadar AQL query detecting RdClient activity through process creation (EventID 4688) for rdclient.exe and supporttool.exe, and registry modifications (EventID 4657) to SOFTWARE\RdClient registry path

References

Acknowledgements

Person: Daniel Koifman
Handle: @KoifSec