An RDP (Remote Desktop Protocol) brute force attack involves an attacker repeatedly attempting various username and password combinations to gain unauthorized access to a remote computer via RDP, and if successful, the potential impact can include unauthorized control over the compromised system, data theft, or the ability to launch further attacks within the network, jeopardizing the security and confidentiality of the targeted system and potentially compromising the entire network infrastructure. This rule identifies multiple consecutive authentication failures targeting a specific user account within a short time interval, followed by a successful authentication.

Rule type: eql

Rule indices:

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References: None

Tags:

Version: 3

Rule authors:

Rule license: Elastic License v2

sequence by host.id, related.user with maxspan=5s
  [authentication where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and
   event.action == "authenticated" and auditd.data.terminal : "*rdp*" and event.outcome == "failure"] with runs=10
  [authentication where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and
   event.action  == "authenticated" and auditd.data.terminal : "*rdp*" and event.outcome == "success"] | tail 1