Detecting RDP Brute Force Attacks

Overview

RDP brute force attacks target Windows Remote Desktop Protocol services by attempting rapid credential guessing against exposed RDP endpoints. Detection relies on analyzing Windows Security Event Logs for Event ID 4625 (failed logon with Logon Type 10 or 3) and correlating with Event ID 4624 (successful logon) to identify compromised accounts. This guide covers parsing EVTX files with python-evtx, identifying attack patterns through source IP frequency analysis, detecting NLA bypass attempts, and generating actionable detection reports.

Prerequisites

• Python 3.9+ with python-evtx, lxml libraries
• Windows Security EVTX log files (exported from Event Viewer or collected via WEF)
• Understanding of Windows authentication Event IDs (4624, 4625, 4776)
• Familiarity with RDP Logon Types (Type 3 for NLA, Type 10 for RemoteInteractive)

Steps

Step 1: Export Security Event Logs

Export Windows Security logs to EVTX format using Event Viewer or wevtutil:

wevtutil epl Security C:\logs\security.evtx

Step 2: Parse Failed Logon Events

Use python-evtx to parse Event ID 4625 entries, extracting source IP, target username, failure reason (Sub Status), and Logon Type fields.

Step 3: Analyze Attack Patterns

Identify brute force patterns by:

• Counting failed logons per source IP within time windows
• Detecting username spray attacks (many usernames from one IP)
• Correlating 4625 failures with subsequent 4624 success from same IP

Step 4: Generate Detection Report

Produce a JSON report with top attacking IPs, targeted accounts, time-based analysis, and compromise indicators.

Expected Output

JSON report containing:

• Total failed logon events and unique source IPs
• Top attacking IPs ranked by failure count
• Targeted usernames and failure sub-status codes
• Successful logons following brute force attempts (potential compromises)
• Time-series analysis of attack intensity

Verification Criteria

Confirm successful execution by validating:

• [ ] All prerequisite tools and access requirements are satisfied
• [ ] Each workflow step completed without errors
• [ ] Output matches expected format and contains expected data
• [ ] No security warnings or misconfigurations detected
• [ ] Results are documented and evidence is preserved for audit

Compliance Framework Mapping

This skill supports compliance evidence collection across multiple frameworks:

• SOC 2: CC7.1 (Monitoring), CC7.2 (Anomaly Detection)
• ISO 27001: A.12.4 (Logging & Monitoring)
• NIST 800-53: SI-4 (System Monitoring), AU-6 (Audit Review)
• NIST CSF: DE.AE (Anomalies & Events), DE.CM (Continuous Monitoring)

Claw GRC Tip: When this skill is executed by a registered agent, compliance evidence is automatically captured and mapped to the relevant controls in your active frameworks.

Deploying This Skill with Claw GRC

Agent Execution

Register this skill with your Claw GRC agent for automated execution:

# Install via CLI
npx claw-grc skills add detecting-rdp-brute-force-attacks

# Or load dynamically via MCP
grc.load_skill("detecting-rdp-brute-force-attacks")

Audit Trail Integration

When executed through Claw GRC, every step of this skill generates tamper-evident audit records:

• SHA-256 chain hashing ensures no step can be modified after execution
• Evidence artifacts (configs, scan results, logs) are automatically attached to relevant controls
• Trust score impact — successful execution increases your agent's trust score

Continuous Compliance

Schedule this skill for recurring execution to maintain continuous compliance posture. Claw GRC monitors for drift and alerts when re-execution is needed.