In a recent whitepaper, Microsoft provides advice on how to spot RDP attacks in Windows event logs while the attack is still underway.

The paper titled:  “Data science for cybersecurity: A probabilistic time series model for detecting RDP inbound brute force attacks” succinctly explains the risk posed by RDP servers when published to the internet:

Computers with Windows Remote Desktop Protocol (RDP) exposed to the internet are an attractive target for adversaries because they present a simple and effective way to gain access to a network. Brute forcing RDP, a secure network communications protocol that provides remote access over port 3389, does not require a high level of expertise or the use of exploits; attackers can utilize many off-the-shelf tools to scan the internet for potential victims and leverage similar such tools for conducting the brute force attack.

The paper details how looking for ETW event 4625 (failed login to a Windows Server) when correlated with information about the source IP address (from firewall logs) and the credentials used can help identify when a server is being subjected for a brute force or credential stuffing attack.

SIEM systems can spot these attacks in progress then alert operations staff and even fire automation rules to disable the RDP service on the affected server or tell the firewall to block the source IP address while investigations continue.

The analysis conducted by Microsoft revealed that brute force attacks against RDP servers typically lasted several days – indicating both the number of credential permutations attempted and that the velocity of the attack is also throttled in an attempt to fly under the radar of security monitoring systems.