ATT&CK T1078 - RDP Brute Force Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects a potential RDP brute force attack by monitoring for a high number of TCP SYN packets directed to port 3389 (RDP) on the home network from a single source IP address within a short timeframe. Specifically, it triggers an alert if 10 or more SYN packets are observed from the same source within 60 seconds, indicating an attempt to establish multiple RDP connections, which is characteristic of a brute force attempt.