Detecting RDP Brute Force Attacks
FreeIdentify and analyze RDP brute force attack patterns.
Free · Opens the source repo
What Detecting RDP Brute Force Attacks does
Detecting RDP Brute Force Attacks is a specialized skill designed for cybersecurity professionals needing to identify and analyze brute force attacks targeting Windows Remote Desktop Protocol (RDP) services. This skill utilizes Python to parse Windows Security Event Logs (EVTX files) for specific event IDs related to failed and successful logon attempts. By focusing on Event ID 4625 for failed logons and correlating it with Event ID 4624 for successful logons, users can effectively detect compromised accounts and identify potential security incidents.
The skill employs the python-evtx library to process the logs, extracting crucial information such as source IP addresses, usernames, and failure reasons. It also analyzes patterns in failed logon attempts, helping users to recognize username spray attacks and correlate failures with subsequent successful logons from the same IP address. This structured approach allows for a comprehensive analysis of RDP brute force attacks, making it easier for security analysts to generate actionable reports.
Intended for security operations center (SOC) analysts and threat hunters, this skill is particularly useful when investigating security incidents involving exposed RDP endpoints. It can assist in building detection rules for security information and event management (SIEM) systems and validating security monitoring coverage for credential guessing techniques. By generating detailed JSON reports, users can gain insights into attack patterns, including the most active attacking IPs and the targeted accounts, enabling them to respond effectively to potential threats.
When to use it
Use this skill when investigating incidents involving RDP brute force attacks or when building detection rules for credential guessing.
When not to use it
This skill is not suitable for environments that do not utilize Windows Security Event Logs or where RDP is not in use.
What you can build with it
Investigating Security Incidents
Use this skill to analyze Windows Security Event Logs when responding to security incidents involving RDP.
Building Detection Rules
Leverage the skill to create detection rules for SIEM systems focused on RDP brute force attack patterns.
Validating Security Monitoring
Employ this skill to confirm the effectiveness of your security monitoring coverage against credential guessing techniques.
How to install Detecting RDP Brute Force Attacks
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/detecting-rdp-brute-force-attacks --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Detecting RDP Brute Force Attacks
Overview
RDP brute force attacks target Windows Remote Desktop Protocol services by attempting rapid credential guessing against exposed RDP endpoints. Detection relies on analyzing Windows Security Event Logs for Event ID 4625 (failed logon with Logon Type 10 or 3) and correlating with Event ID 4624 (successful logon) to identify compromised accounts. This skill covers parsing EVTX files with python-evtx, identifying attack patterns through source IP frequency analysis, detecting NLA bypass attempts, and generating actionable detection reports.
When to Use
- When investigating security incidents that require detecting rdp brute force attacks
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Python 3.9+ with
python-evtx,lxmllibraries - Windows Security EVTX log files (exported from Event Viewer or collected via WEF)
- Understanding of Windows authentication Event IDs (4624, 4625, 4776)
- Familiarity with RDP Logon Types (Type 3 for NLA, Type 10 for RemoteInteractive)
Steps
Step 1: Export Security Event Logs
Export Windows Security logs to EVTX format using Event Viewer or wevtutil:
wevtutil epl Security C:\logs\security.evtx
Step 2: Parse Failed Logon Events
Use python-evtx to parse Event ID 4625 entries, extracting source IP, target username, failure reason (Sub Status), and Logon Type fields.
Step 3: Analyze Attack Patterns
Identify brute force patterns by:
- Counting failed logons per source IP within time windows
- Detecting username spray attacks (many usernames from one IP)
- Correlating 4625 failures with subsequent 4624 success from same IP
Step 4: Generate Detection Report
Produce a JSON report with top attacking IPs, targeted accounts, time-based analysis, and compromise indicators.
Expected Output
JSON report containing:
- Total failed logon events and unique source IPs
- Top attacking IPs ranked by failure count
- Targeted usernames and failure sub-status codes
- Successful logons following brute force attempts (potential compromises)
- Time-series analysis of attack intensity
Frequently asked questions about Detecting RDP Brute Force Attacks
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.