RDP is commonly used by administrators to do routine maintenance tasks. Once hacker has got initial foodhold; compromising domain admin credentials is very easy using RDP MITM. This short clips walks through the process.