RDP Brute Force Detected

SOC Alert Details

	SEVERITY	DATE	RULE NAME	EVENTID	TYPE
	Medium	Mar, 07, 2024, 11:44 AM	SOC176 - RDP Brute Force Detected	234	Brute Force
	EventID : 234 Event Time : Mar, 07, 2024, 11:44 AM Rule : SOC176 - RDP Brute Force Detected Level : Security Analyst Source IP Address : 218.92.0.56 Destination IP Address : 172.16.17.148 Destination Hostname : Matthew Protocol : RDP Firewall Action : Allowed Alert Trigger Reason : Login failure from a single source with different non existing accounts Show Hint

Playbook Answers

Question:Should the device be isolated?

User answer:Yes

Question:Log Management

User answer:Yes

Question:Determine the Scope

User answer:No

Question:Traffic Analysis

User answer:No

Correct Answer:Yes

Question:IP Reputation Check

User answer:Yes

Question:Enrichment & Context

User answer:External

Playbook Note

On March 7, 2024, at 11:44 AM, our SIEM detected a brute force attack on RDP, flagged under rule SOC176. The source IP 218[g]92.0.56 identified as originating from China made multiple login attempts using various non-existing accounts against host "Matthew" (IP: 172[g]16.17.148). Following a successful login, the attacker executed several commands (launching cmd.exe, running "whoami", checking user accounts with "net user letsdefend", listing local administrators, and running "netstat -ano") at 11:45:18 to probe the system. Swift containment actions were taken, and Matthew’s workstation has been isolated to prevent any further compromise.

Extracted Artifacts

Value	Comment	Type
218[g]92.0.56	Malicious IP	IP Address
China	Malicious IP Location	E-mail Domain

Alert Answers

Question:Is this alert True Positive or False Positive?

User answer:

Alert Note

On March 7, 2024, at 11:44 AM, our SIEM detected a brute force attack on RDP, flagged under rule SOC176. The source IP 218[g]92.0.56 identified as originating from China made multiple login attempts using various non-existing accounts against host "Matthew" (IP: 172[g]16.17.148). Following a successful login, the attacker executed several commands (launching cmd.exe, running "whoami", checking user accounts with "net user letsdefend", listing local administrators, and running "netstat -ano") at 11:45:18 to probe the system. Swift containment actions were taken, and Matthew’s workstation has been isolated to prevent any further compromise.

Score

Playbook Success Rate

Investigation Time

SOC Alert Details

Playbook Answers

Playbook Note

Extracted Artifacts

Alert Answers

Alert Note