Blocking RDP brute-force attacks
According to Sophos, in the first half of 2023, adversaries leveraged Remote Desktop Protocol (RDP) in 95% of attacks, increased by 88% from 2023. RDP is a Microsoft-developed proprietary protocol that allows users to connect to and remotely operate another computer or device via a network connection. Attackers employ automated software to try many login and password combinations in order to obtain unauthorized access to systems via RDP. Mitigating such risks involves proactive measures as well as quick action to block malicious IP addresses that try these assaults. In this section, we will utilize Wazuh active response to block the attacker’s IP address against an RDP brute-force attack. We will cover the following points:
- Requirement
- Setting up a Windows agent with an active response script
- Setting up the Wazuh server with a rule and active response script
- Testing
- Visualization
Requirement
In this use case...
