RDP Credential Spray - Multiple Usernames

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects RDP credential spraying attempts targeting multiple usernames on a single destination IP address. It triggers an alert if 30 or more RDP connection attempts are made to the same destination within a 60-second window, indicating a potential brute-force or credential-stuffing attack against RDP services.