APP: Windows Remote Desktop Protocol (RDP) Brute Force Attempt
This signature detects numerous Windows Remote Desktop Protocol (RDP) connections between two peers in a short period of time, which can be an indication of a Brute Force Attack (also known as a "Dictionary Attack"). An attacker may be attempting to guess valid credentials on an RDP-enabled Windows PC. A successful attack could result in arbitrary code execution with the privileges of the compromised credentials.
Short Name
APP:RDP-BRUTE-FORCE
Severity
Major
Recommended
False
Recommended Action
Drop
Category
APP
Keywords
(RDP) Attempt Brute Desktop Force Protocol Remote Windows
Release Date
09/01/2011
Supported Platforms
srx-branch-19.3
vsrx3bsd-19.2
srx-19.4
vsrx3bsd-19.4
srx-branch-19.4
vsrx-19.4
vsrx-19.2
srx-19.3
srx-branch-12.3
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx-12.3
vmx-19.3
srx-12.3
Sigpack Version
3360
False Positive
Unknown