The application provides a method and apparatus for remote desktop control identification. The method comprises the following steps that: S1, an untrusted process is injected and HOOK is carried out on a remote desktop control behavior function in the untrusted process; S2, whether a remote desktop control operation exists is determined according to an operation function; if so, a step S3 is executed; S3, whether network communication exists is determined according to a communication function; if so, a step S4 is executed; S4, the communication function is configured and the network communication is blocked according to preset time; S5, whether a remote desktop control operation exists within the network communication blocking time is determined; if so, a step S6 is executed; S6, the network communication is restored and whether a preset number of times for detection is satisfied is determined; if so, a step S7 is executed; and if not, the step S2 is returned; and S7, whether the current untrusted process is the remote desktop control process is determined. According to the application, security of a computer and various user terminal applications is improved.