skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-rdp-brute-force-attacks

Detect RDP brute force attacks by analyzing Windows Security Event Logs for failed logon patterns.

954|172|Updated Mar 13, 2026
Search Tags:#incident response#threat detection#brute force#siem#rdp#evtx#windows event logs
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-rdp-brute-force-attacks
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-rdp-brute-force-attacks
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-detection/detecting-rdp-brute-force-attacks
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-rdp-brute-force-attacks

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python-evtx, lxml.

What problem does it solve?

RDP brute force attacks against exposed Windows endpoints often go unnoticed because raw Security Event Logs are voluminous and naive detection rules miss NLA-fronted attempts, low-and-slow spraying, and the critical failed-to-successful logon correlation that signals compromise.

Core Features & Use Cases

  • EVTX Log Parsing: Parse Windows Security Event Logs with python-evtx to extract Event ID 4625 (failed logon), 4624 (successful logon), and 4776 (credential validation) records with source IP, username, Sub Status, and Logon Type fields.
  • Attack Pattern Analysis: Identify brute force behavior through per-source-IP failure counting, username spray detection, and correlation of 4625 failure bursts followed by 4624 Type 10 successes from the same IP.
  • Detection Gap Guidance: Covers NLA bypass scenarios, Logon Type 3 vs Type 10 paths, Sub Status code interpretation, and false-positive tuning for scanners and stale service accounts.
  • Use Case: A SOC analyst investigating a suspected RDP compromise exports security.evtx from a Windows server, runs the parsing and correlation steps, and receives a JSON report ranking attacking IPs and flagging any successful logon that followed a brute force burst.

Quick Start

Analyze the exported Windows Security event log security.evtx for RDP brute force attack patterns and generate a JSON detection report of attacking IPs and potential compromises.

Frequently Asked Questions about detecting-rdp-brute-force-attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect RDP brute force attacks in Windows Event Logs?▼

Detect RDP brute force attacks by parsing Security Event Logs for Event ID 4625 with Logon Type 10 or 3, counting failures per source IP, and correlating with Event ID 4624 successes from the same IP. Use python-evtx to extract source IP, username, and Sub Status fields from exported EVTX files.

How to parse EVTX files with Python for security analysis?▼

Parse EVTX files with the python-evtx library, which reads Windows Event Log binary format and yields XML records per event. Combine it with lxml to extract fields like Event ID, source IP, target username, and Logon Type for downstream frequency and correlation analysis.

Why does my RDP brute force detection rule miss attacks?▼

Rules counting only Event ID 4625 Logon Type 10 miss NLA-fronted attempts logged as Type 3 and credential failures recorded as 4776 on the domain controller. Low-and-slow spraying also defeats per-IP thresholds, so aggregate failures per target account and watch for a 4624 Type 10 success after failure bursts.

What Windows Event IDs indicate RDP logon failures?▼

Event ID 4625 records failed logons, with Logon Type 10 for RemoteInteractive and Type 3 for network-level NLA attempts. Event ID 4776 captures credential validation on domain controllers, and Sub Status codes like 0xC000006A (bad password) and 0xC0000064 (no such user) clarify failure causes.

How do I reduce false positives in RDP brute force alerts?▼

Reduce false positives by excluding vulnerability scanners, expired-password storms after policy changes, and service accounts with stale cached credentials. Baseline normal source IPs and geographies, then alert on first-seen external IPs rather than raw failure counts alone.

Related Skills

Explore More Software Engineering Skills→
AxxxxxxaaannAxxxxxxaaann

analyzing-windows-event-logs-in-splunk

Analyze Windows event logs in Splunk using SPL queries mapped to MITRE ATT&CK techniques.

Community
Advanced
marquesfelipmarquesfelip

brute-force-protection

Enforce rate limits, lockouts, and MFA on authentication endpoints.

Community
Advanced
msandbumsandbu
2

geomap-visualization

Generates interactive geographic maps of IP addresses to visualize attack origins and security events.

Community
Advanced
GhostPWNGhostPWN
4

Network Security & Traffic Analysis

Analyze PCAP files and firewall configurations to generate Suricata, Snort, and Zeek detection rules.

Official
Advanced