Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
An attacker might run tools such as Ncrack or Hydra to perform a brute force attack on Remote Desktop Protocol (RDP) accounts to find weak passwords or valid login credentials, or perform a scan to discover and exploit known vulnerabilities.
Kill Chain
Risk Score
—
Block inbound and outbound traffic from suspicious hosts at the network perimeter
Quarantine the device while checking for indicators of compromise, such as the presence of malware
Limit the number of RDP login attempts, and then lock user accounts that exceed this number
Review access controls to ensure that only authorized users can connect to remote access services with RDP
Review authentication methods and enforce policies for secure credential creation, strong authentication methods for remote access services, and multi-factor authentication
Implement microsegmentation by adding secure zones based on the zero-trust security model: partition network traffic with endpoint firewalls, virtual or software-defined networks, or physical networks
