Possible external RDP Brute-Force

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	10 Minutes
Deduplication Period	1 Day
Required Data	XDR Agent
Detection Modules	Identity Analytics
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Brute Force: Password Guessing (T1110.001)
Severity	Low

Description

Multiple failed remote logins originated from an external IP with at least one successful login. This may indicate a successful brute-force attack.

Attacker's Goals

The attacker attempts to gain access to the accounts.

Investigative actions

• If the source IP is an internal IP, adjust network IP ranges.
• Identify the user performing RDP and check that it is authorized.
• Check whether this IP has a malicious reputation.
• Reset the user's password.
• Follow further actions done by the user.

Variations

Possible external RDP Brute-Force on a Honey User Account

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Brute Force: Password Guessing (T1110.001)
Severity	Medium

Description

Multiple failed remote logins originated from an external IP with at least one successful login. This may indicate a successful brute-force attack.

Attacker's Goals

The attacker attempts to gain access to the accounts.

Investigative actions

• If the source IP is an internal IP, adjust network IP ranges.
• Identify the user performing RDP and check that it is authorized.
• Check whether this IP has a malicious reputation.
• Reset the user's password.
• Follow further actions done by the user.

Potential External Brute-Force via RDP on Sensitive User

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Brute Force: Password Guessing (T1110.001)
Severity	Medium

Description

Multiple failed remote logins from an external IP with a sensitive user and at least one successful login. This may indicate a successful brute-force attack.

Attacker's Goals

The attacker attempts to gain access to the accounts.

Investigative actions

• If the source IP is an internal IP, adjust network IP ranges.
• Identify the user performing RDP and check that it is authorized.
• Check whether this IP has a malicious reputation.
• Reset the user's password.
• Follow further actions done by the user.