TCP Port 3389 – RDP (Microsoft Remote Desktop Protocol)

Port 3389 is the standard port for the Microsoft Remote Desktop Protocol (RDP), the technology Windows uses to deliver a full graphical desktop session from one Windows machine to another over the network. When an IT administrator connects to a Windows server to perform maintenance, when a user works from home by remoting into their office desktop, or when a managed service provider supports a client’s environment, the underlying connection typically runs through RDP on port 3389. The IANA assignment registers this port as “ms-wbt-server” (Microsoft Windows-Based Terminal Server), reflecting the protocol’s origin in the Terminal Services feature first introduced in Windows NT 4.0.

RDP delivers more than just a remote shell. The protocol carries the full Windows desktop interface: the screen is rendered remotely and streamed to the client, while the client sends keyboard, mouse, and clipboard input back. Modern RDP also supports redirection of local printers, drives, audio, and USB devices into the remote session, making the experience close to using the remote machine directly.

RDP is the dominant technology for remote Windows administration in business environments and is widely used for remote desktop access in home and small-office settings. Outbound TCP/3389 from end-user devices is normal in IT-administration and remote-work contexts and uncommon outside them. Inbound TCP/3389 from the public internet to any host is unusual in 2026 and is widely treated as a serious security exposure.

Port 3389 is also defined for UDP in the IANA registry. UDP/3389 is supported by modern RDP implementations as a transport for performance-sensitive components like display and audio data, but the primary session control still uses TCP.

About TCP Port 3389

Port 3389 carries the IANA assignment for ms-wbt-server. The IANA description reads: ‘MS WBT Server’.

Security Considerations

RDP exposed directly to the public internet is one of the most-attacked services on the internet today, comparable to SSH on port 22 and SMB on port 445 in the volume and persistence of attack traffic it attracts. Our data shows 131 IDS rules referencing port 3389. As with SSH, this rule count substantially understates the real exposure: the dominant attack against exposed RDP is automated credential brute-forcing and credential-stuffing, which most IDS rule sets do not flag rule-by-rule. Any internet-facing RDP server with a public IP receives a continuous stream of login attempts using common usernames and breached password lists.

The most consequential RDP-specific vulnerabilities of recent years were BlueKeep (CVE-2019-0708), disclosed in May 2019, and the related DejaBlue family (CVE-2019-1181 and CVE-2019-1182) disclosed in August 2019. All three were pre-authentication remote code execution flaws affecting older Windows versions, and all three were considered “wormable,” meaning a successful exploit could spread automatically from machine to machine. Microsoft took the unusual step of patching long-out-of-support Windows versions (Windows XP and Windows Server 2003) for BlueKeep, and CISA issued public alerts urging immediate patching. A predicted self-propagating worm based on BlueKeep never materialized at internet scale, but exploit code became widely available and is regularly used by threat actors against unpatched systems. Sample rule sid=50137 in our dataset detects a specific BlueKeep technique (the MS_T120 virtual channel bind).

Beyond the headline vulnerabilities, RDP is a primary access vector for ransomware operators. Many ransomware incidents in recent years have begun with an attacker purchasing or brute-forcing valid RDP credentials, logging in interactively, disabling security tools, and deploying ransomware across the network. Initial Access Brokers, criminal middlemen who sell working RDP credentials to ransomware affiliates, are an established part of the criminal economy.

Common practice for hardening RDP is well-established. Network Level Authentication (NLA) should be enabled, which requires the client to authenticate before a session is established and blocks pre-authentication exploit techniques. Account lockout policies and complex password requirements limit brute-force success. Where remote access is genuinely needed, RDP should be placed behind a VPN or a dedicated RDP gateway rather than exposed directly to the internet, and access should be restricted to specific source IP ranges where possible. Multi-factor authentication on RDP logins, available through several Microsoft and third-party products, raises the bar substantially against credential-based attacks.

Inbound TCP/3389 from the public internet to any host is a strong signal of exposure that warrants immediate attention. Outbound TCP/3389 from an end-user device to an unfamiliar destination is uncommon and may indicate either a remote-administration tool or, in some malware contexts, an attacker pivoting outward from a compromised internal host.

IDS Rule References

131 IDS / security rules reference TCP port 3389. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.

Rule categories (top 6): command-and-control (118), protocol-command-decode (4), attempted-admin (3), network-scan (2), misc-activity (1), attempted-recon (1).

Sample rule descriptions for TCP port 3389:

• POLICY-OTHER Microsoft Windows Terminal server RDP attempt
• POLICY-OTHER Microsoft Windows Terminal server request attempt
• POLICY-OTHER Microsoft Windows Terminal Server no encryption session initiation attempt
• OS-WINDOWS Microsoft Windows empty RDP cookie negotiation attempt
• OS-WINDOWS Microsoft Windows RDP MS_T120 channel bind attempt

Malware Activity

Malware activity is frequently observed on this port.

121 of 131 IDS rules for TCP port 3389 involve malware activity.

Families observed (top 1): Bluekeep (1).

Data Sources

This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), and Snort Community Rules (GPLv2).