Analysis of a large brute force attack campaign against Windows Remote Desktop

• EvlWatcher

  5 341 5.1 C#

  a "fail2ban" style modular log file analyzer for windows

• ts_block

  4 175 0.0 Visual Basic

  Blocks IP addresses generating invalid Terminal Services logons

My old ts_block[0] project does something similar to yours, albeit for RDP only and with much less sophisticated customization.

I opted to go with a WMI Event Sink rather than polling the Event Log. I've never done a benchmark to see which architecture would use less CPU, but I can say the WMI event sink causes nearly instantaneous reaction.

As an aside: I'd love to hear if somebody tries ts_block on Windows Server 2022. It works fine on 2012 R2 thru 2019 but I've never tried it on 2022.

[0] https://github.com/EvanAnderson/ts_block

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• ts_block

  1 7 2.6 VBScript

  Blocks IP addresses generating invalid Terminal Services logons (by greatquux)

• nlahoney

  1 10 1.8 C

  NLA Honeypot Associated Research

  

A few links which provide some good insight for your idea.

https://research.nccgroup.com/2021/10/21/cracking-rdp-nla-su...

https://github.com/nccgroup/nlahoney

Suggest a related project