RDP Brute Force Followed by Successful Login

Kenji Choy@kchoy

•updated May 28, 2026•2•0•29

This rule detects a successful Remote Desktop Protocol (RDP) login that is immediately preceded by 20 or more failed RDP authentication attempts from the same source IP to the same destination IP within a 15-minute window. This pattern is indicative of a brute force attack that has successfully compromised credentials.