Skip to main content
Version: 7.4

Remote Desktop

Brute Force Remote Desktop Access

Identifying brute force remote desktop access attempts is vital in the realm of network security, particularly as remote desktop protocols like Microsoft's Remote Desktop Protocol (RDP) are widely used for accessing systems remotely. Brute force attacks on these services involve repeated attempts to guess login credentials, aiming to gain unauthorized access. Successful breaches can lead to severe consequences, including data theft, system compromise, and the deployment of malware or ransomware. Given the critical nature of these attacks, early detection is key to preventing unauthorized access and safeguarding sensitive data and systems.

ElastiFlow provides a collection of anomaly detection jobs designed to identify brute force remote desktop access attempts encompassing several focused strategies for monitoring and analyzing access patterns.

Attributes

AttributeInformation
Analysis Typepopulation
MITRE ATT&CK TechniqueBrute Force (T1110)
MITRE ATT&CK Sub-TechniquePassword Guessing (T1110.001)
MITRE ATT&CK TacticCredential Access (TA0006)

Downloads

SchemaVectorPerspectiveWindowLink
CODEXdirectedgefastelastiflow_codex_netsec_bruteforce_direct_desktop_edge_fast
CODEXdirectedgeslowelastiflow_codex_netsec_bruteforce_direct_desktop_edge_slow
CODEXdirectinboundfastelastiflow_codex_netsec_bruteforce_direct_desktop_in_fast
CODEXdirectinboundslowelastiflow_codex_netsec_bruteforce_direct_desktop_in_slow
CODEXdirectoutboundfastelastiflow_codex_netsec_bruteforce_direct_desktop_out_fast
CODEXdirectoutboundslowelastiflow_codex_netsec_bruteforce_direct_desktop_out_slow
CODEXdirectprivatefastelastiflow_codex_netsec_bruteforce_direct_desktop_priv_fast
CODEXdirectprivateslowelastiflow_codex_netsec_bruteforce_direct_desktop_priv_slow
CODEXdistributededgefastelastiflow_codex_netsec_bruteforce_distrib_desktop_edge_fast
CODEXdistributededgeslowelastiflow_codex_netsec_bruteforce_distrib_desktop_edge_slow
CODEXdistributedinboundfastelastiflow_codex_netsec_bruteforce_distrib_desktop_in_fast
CODEXdistributedinboundslowelastiflow_codex_netsec_bruteforce_distrib_desktop_in_slow
CODEXdistributedoutboundfastelastiflow_codex_netsec_bruteforce_distrib_desktop_out_fast
CODEXdistributedoutboundslowelastiflow_codex_netsec_bruteforce_distrib_desktop_out_slow
CODEXdistributedprivatefastelastiflow_codex_netsec_bruteforce_distrib_desktop_priv_fast
CODEXdistributedprivateslowelastiflow_codex_netsec_bruteforce_distrib_desktop_priv_slow
ECSdirectedgefastelastiflow_ecs_netsec_bruteforce_direct_desktop_edge_fast
ECSdirectedgeslowelastiflow_ecs_netsec_bruteforce_direct_desktop_edge_slow
ECSdirectinboundfastelastiflow_ecs_netsec_bruteforce_direct_desktop_in_fast
ECSdirectinboundslowelastiflow_ecs_netsec_bruteforce_direct_desktop_in_slow
ECSdirectoutboundfastelastiflow_ecs_netsec_bruteforce_direct_desktop_out_fast
ECSdirectoutboundslowelastiflow_ecs_netsec_bruteforce_direct_desktop_out_slow
ECSdirectprivatefastelastiflow_ecs_netsec_bruteforce_direct_desktop_priv_fast
ECSdirectprivateslowelastiflow_ecs_netsec_bruteforce_direct_desktop_priv_slow
ECSdistributededgefastelastiflow_ecs_netsec_bruteforce_distrib_desktop_edge_fast
ECSdistributededgeslowelastiflow_ecs_netsec_bruteforce_distrib_desktop_edge_slow
ECSdistributedinboundfastelastiflow_ecs_netsec_bruteforce_distrib_desktop_in_fast
ECSdistributedinboundslowelastiflow_ecs_netsec_bruteforce_distrib_desktop_in_slow
ECSdistributedoutboundfastelastiflow_ecs_netsec_bruteforce_distrib_desktop_out_fast
ECSdistributedoutboundslowelastiflow_ecs_netsec_bruteforce_distrib_desktop_out_slow
ECSdistributedprivatefastelastiflow_ecs_netsec_bruteforce_distrib_desktop_priv_fast
ECSdistributedprivateslowelastiflow_ecs_netsec_bruteforce_distrib_desktop_priv_slow

By implementing this suite of anomaly detection jobs, organizations can proactively monitor and rapidly identify brute force attempts on remote desktop services. This early detection enables timely intervention, such as implementing account lockouts, enhancing password policies, or even temporarily disabling access from suspicious IP addresses. Such proactive measures are essential for maintaining the security of remote desktop services, which are critical for day-to-day operations and remote access in today's increasingly distributed work environments.