Brute Force Attacks Against Internet-Exposed RDP/RD Gateway/RDWeb, SSH and macOS Logins (Huntress Brute Force Sentry)

Key facts for Brute Force Sentry login attacks

Detection coverage for Brute Force Sentry login attacks

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5457 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Brute Force Burst Followed by Successful Logon on Exposed RDP/RD Gateway/RDWeb (T1110) — Exploitation

Behaviour-first Splunk search for the Brute Force Sentry condition: 20 or more Windows Security Event ID 4625 failed network/RDP logons from one source against one account, followed by a 4624 success in the same 30-minute window. Matches the June 2026 pattern (about 212-215 failures per account before compromise). Indicates exposed-login brute force (T1110.001) ending in valid account use (T1078, T1133).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1110, T1110.001, T1078, T1133
• Data sources: wineventlog:security (index=wineventlog), windows_security 4624/4625
• Severity: high
• Confidence: high

Splunk SPL

index=wineventlog sourcetype="WinEventLog:Security" (EventCode=4625 OR EventCode=4624) Logon_Type IN (3,10) earliest=-30m@m
```TL-2026-5457 T1110: burst of 4625 failures followed by a 4624 success from the same source and account (Brute Force Sentry condition)```
| eval target_user=lower(mvindex(Account_Name,-1)), src=Source_Network_Address
| where isnotnull(src) AND NOT match(src,"^(-|::1|127\.0\.0\.1)$") AND NOT match(target_user,"\$$")
| stats count(eval(EventCode=4625)) AS failures, count(eval(EventCode=4624)) AS successes, min(eval(if(EventCode=4625,_time,null()))) AS first_fail, max(eval(if(EventCode=4624,_time,null()))) AS last_success, values(Logon_Type) AS logon_types, values(host) AS hosts by src, target_user
| where failures>=20 AND successes>=1 AND last_success>first_fail
| eval first_fail=strftime(first_fail,"%F %T"), last_success=strftime(last_success,"%F %T")
| table src, target_user, hosts, failures, successes, logon_types, first_fail, last_success

Microsoft KQL

// TL-2026-5457 T1110 / T1078: failed-logon burst followed by success (RDP, RD Gateway, RDWeb network logons)
let lookback = 1h;
let failThreshold = 20;
SecurityEvent
| where TimeGenerated > ago(lookback)
| where EventID in (4625, 4624) and LogonType in (3, 10)
| where isnotempty(IpAddress) and IpAddress !in ("-", "::1", "127.0.0.1")
| where TargetUserName !endswith "$"
| summarize failures = countif(EventID == 4625), successes = countif(EventID == 4624),
    firstFail = minif(TimeGenerated, EventID == 4625), lastSuccess = maxif(TimeGenerated, EventID == 4624),
    logonTypes = make_set(LogonType) by IpAddress, TargetUserName, Computer
| where failures >= failThreshold and successes >= 1 and lastSuccess > firstFail
| project IpAddress, TargetUserName, Computer, failures, successes, logonTypes, firstFail, lastSuccess

Sigma

title: Failed Network/RDP Logon Burst Against Exposed Login Surface
id: 3f6a1c52-7b0e-4d8a-9c41-5e2b8d7a1f01
name: tl_5457_win_failed_exposed_logon
status: experimental
description: Windows Security 4625 failed logons of type 3 (network, RD Gateway/RDWeb) or 10 (RemoteInteractive, RDP). The paired correlation fires on 20 or more failures per source and account in 5 minutes, the brute-force burst preceding a successful compromise (TL-2026-5457).
references:
    - https://www.huntress.com/blog/brute-force-sentry
    - https://attack.mitre.org/techniques/T1110/
    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-07
tags:
    - attack.credential-access
    - attack.t1110
    - attack.t1110.001
    - attack.initial-access
    - attack.t1133
    - attack.t1078
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4625
        LogonType:
            - 3
            - 10
    filter_local:
        IpAddress:
            - '-'
            - '::1'
            - '127.0.0.1'
    filter_machine_account:
        TargetUserName|endswith: '$'
    condition: selection and not 1 of filter_*
falsepositives:
    - Users with expired or mistyped passwords and misconfigured services or scheduled tasks using stale credentials
    - Vulnerability scanners and monitoring probes authenticating to RDP
level: medium
---
title: Brute Force Burst Against Exposed Login Surface (20+ Failures in 5 Minutes)
id: 3f6a1c52-7b0e-4d8a-9c41-5e2b8d7a1f02
status: experimental
description: Correlation of tl_5457_win_failed_exposed_logon, 20 or more failures from one source against one account within 5 minutes.
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-07
tags:
    - attack.credential-access
    - attack.t1110
correlation:
    type: event_count
    rules:
        - tl_5457_win_failed_exposed_logon
    group-by:
        - IpAddress
        - TargetUserName
    timespan: 5m
    condition:
        gte: 20
falsepositives:
    - Service accounts with stale credentials retrying aggressively
level: high

Known false positives:

• Service accounts or scheduled tasks retrying with stale credentials before a valid logon
• Users who mistype passwords repeatedly and then log on successfully
• Vulnerability scanners and monitoring probes against RDP

Tuning notes: Raise or lower the failure threshold (20) per baseline; allowlist known scanner and VPN egress addresses; add a 4776 join on domain controllers; for the 72-second burst pattern add a bin _time span=2m variant. Adjust the index name to your Splunk Windows inputs.

• 🔒 Sentinel: Failed Logon Burst Then Success on Exposed RDP/RDWeb/RD Gateway (T1110) — Exploitation · unlock with TL Creds
• 🔒 Sentinel: Distributed Brute Force and Password Spraying on Exposed Logins (T1110.003/T1110.004) — Post-Exploitation Recon/Spray · unlock with TL Creds
• 🔒 Sentinel: sshd Failed Logons Followed by Accepted Login on Linux (T1110.001 / T1021.004) — Lateral Access · unlock with TL Creds
• 🔒 Sigma: Failed Network/RDP Logon Burst Against Exposed Login Surface (T1110) — Exploitation · unlock with TL Creds
• 🔒 Sigma: Lockout and NTLM Validation Failures Indicating Password Spraying (T1110.003) — Post-Exploitation Recon/Spray · unlock with TL Creds
• 🔒 Sigma: RDP Logon Activity From IPs Tied to Related Huntress RDP Brute-Force Case (T1021.001) — Lateral Access · unlock with TL Creds
• 🔒 Password Spraying, Credential Stuffing and Username Enumeration Against Windows Logins (T1110.003) — Post-Exploitation Recon/Spray · unlock with TL Creds
• 🔒 SSH Brute Force Followed by Accepted Login on Linux (T1110.001 / T1021.004) — Lateral Access · unlock with TL Creds

Indicators of compromise for Brute Force Sentry login attacks

As of 2026-11-07, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5457.

Sample indicators (3 of 7)

• IP address: 64.190.113[.]159
• Domain: nologs[.]club
• IP address: 147.135.36[.]162

Defanged, TLP:CLEAR. Full set of 7 indicators: unlock with TL Creds.

How Brute Force Sentry login attacks works

A June 2026 incident saw roughly 1,700 attempted logins across eight accounts in 72 seconds, ending in a successful compromise.

This record documents a generic, ongoing credential-attack pattern rather than a single named campaign. The primary source is a Huntress product and detection announcement published 2026-11-06. It names no CVE, threat actor, malware family or network indicators.

The source distinguishes five attack variants against internet-exposed authentication surfaces. Traditional brute force is a single source hammering a few accounts. Distributed brute force uses many sources per account so each source looks inconspicuous. Credential spraying tests common credentials across many accounts. Credential stuffing replays username/password pairs from previous breaches. Username enumeration probes accounts that do not exist. Targeted services are RDP, RD Gateway, RDWeb (Windows), SSH (Linux) and macOS authentication.

Huntress states that RDP is involved in 10-20% of the ways advanced attackers break into networks. In a June 2026 case study, eight accounts each received about 212-215 failed logons (about 1,700 attempts in 72 seconds) before a successful compromise. In a review of 30 confirmed RDWeb/RD Gateway compromises during the first four weeks of testing, Huntress says earlier detection of up to one hour would have been possible in 20 of them.

Brute Force Sentry normalizes authentication telemetry across platforms: Windows Security events 4624, 4625, 4740 and 4776, Linux sshd logs, RD Gateway connection logs and macOS native authentication records. It uses platform-specific tuning instead of generic threshold rules and alerts when a successful login follows brute-force-style activity. It is included with Huntress Managed SIEM and activates automatically once Windows authentication telemetry flows.

Related public reporting (BleepingComputer, 2026-03-04) describes a separate March 2026 Huntress Tactical Response case in which a routine brute-force alert on an exposed RDP server led to a ransomware-as-a-service initial-access infrastructure; the account was compromised from multiple IP addresses, followed by domain enumeration and credential hunting (Procdump, Mimikatz, Secretsdump). Those details belong to that case and are recorded here only as related context. MITRE ATT&CK detection strategy DET0463 for T1110 likewise calls for correlating many failed logons with a subsequent success.

Severity (MEDIUM) and status (MONITORING) are analyst-assigned and are not stated in the source. No attribution, motivation or affected product versions are given. Defender takeaways from the source: enforce MFA on exposed portals, place RD Gateway behind a VPN rather than exposing it directly, monitor internet-facing authentication, and rotate shared or legacy credentials.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol; T1021.004 Remote Services: SSH

Initial Access

T1078 Valid Accounts; T1133 External Remote Services

Credential Access

T1110 Brute Force; T1110.001 Password Guessing; T1110.003 Password Spraying; T1110.004 Credential Stuffing

Reconnaissance

T1589 Gather Victim Identity Information

Remediation for Brute Force Sentry login attacks

Immediate actions

• Enforce MFA on all internet-exposed portals (RDWeb, RD Gateway, SSH, macOS remote login)
• Rotate credentials for accounts targeted by brute-force activity, including shared and legacy credentials
• Review authentication logs for successful logins that follow bursts of failures (Windows 4625 then 4624, sshd failures then Accepted)

Workarounds

• Restrict exposed login surfaces by source address where possible
• Alert on account lockouts (event 4740) and NTLM validation failures (event 4776)

Longer-term hardening

• Place RD Gateway and RDP behind a VPN instead of exposing them directly to the internet
• Continuously monitor internet-facing authentication across Windows, Linux and macOS
• Deploy platform-aware brute-force detection (for example Huntress Brute Force Sentry) in place of generic threshold rules

Affected and fixed versions

• Microsoft — Remote Desktop Protocol / RD Gateway / RDWeb (Windows)
  Vulnerable versions: Internet-exposed instances without MFA
• OpenSSH / Linux — SSH (sshd)
  Vulnerable versions: Internet-exposed instances with password authentication
• Apple — macOS login / remote authentication
  Vulnerable versions: Internet-exposed instances without MFA

Timeline of Brute Force Sentry login attacks

• 2019-08-08 CISA relays the Australian ACSC advisory on password spraying attacks against externally exposed services such as webmail, remote desktop and cloud services
• 2026-03-04 BleepingComputer publishes Huntress Tactical Response findings on a March 2026 case where a routine brute-force alert on an exposed RDP server led to a ransomware-as-a-service initial-access infrastructure (related context, not the June incident)
• 2026-06-01 The June 2026 brute-force burst ended in a successful login and compromise of an account (date approximated to the month in the source)
• 2026-06-01 June 2026 incident (exact day not stated in source): about 1,700 login attempts across eight accounts (about 212-215 failed logons each) within 72 seconds
• 2026-11-06 Brute Force Sentry is announced as included with Huntress Managed SIEM, normalizing Windows 4624/4625/4740/4776, sshd, RD Gateway and macOS authentication telemetry; Huntress reports 20 of 30 reviewed RDWeb/RD Gateway compromises could have been detected up to one hour earlier
• 2026-11-06 Huntress publishes 'Introducing Brute Force Sentry', describing brute force, spraying, stuffing and enumeration against RDP, RD Gateway, RDWeb, SSH and macOS logins
• 2026-11-07 Threadlinqs begins tracking the pattern for its detection-engineering value (no CVE, actor or IOCs named in the primary source)

Sources cited for Brute Force Sentry login attacks

• CISA: ACSC Releases Advisory on Password Spraying Attacks CISA · Government advisory · 2019-08-08
• Introducing Brute Force Sentry: See Who's Knocking on Your Exposed Logins, and Know When One Gets In Huntress · Vendor report · 2026-11-06
• MITRE ATT&CK T1110 Brute Force (detection strategy DET0463) MITRE · Research
• MITRE ATT&CK T1110.003 Password Spraying MITRE · Research
• MITRE ATT&CK T1133 External Remote Services MITRE · Research
• MITRE ATT&CK T1021.001 Remote Desktop Protocol MITRE · Research
• MITRE ATT&CK T1078 Valid Accounts MITRE · Research
• Microsoft: Event 4625 - An account failed to log on Microsoft · Vendor report
• How a Brute Force Attack Unmasked a Ransomware Infrastructure Network (BleepingComputer, Huntress Tactical Response) BleepingComputer · News · 2026-03-04

More in threat intel

• Top 10 Critical Threat Actors to Watch in 2026: Akira, DragonForce, Qilin, LockBit, Scattered Spider, Cl0p, Lazarus, Volt Typhoon, APT29, OilRig (CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088)
• ARTEX agentic AI offensive framework abuse expands as Storm-3358 targets financial sector
• OpenAI GPT-6 Cyber AI Model Finds 81 Firefox Flaws and Develops Root Exploits for 948 Linux Kernel Flaws
• France Cyber Threat Outlook: Dark Web Credential Trade, Ransomware (Qilin/MedusaLocker/LockBit) and NoName057(16) Hacktivism
• Insider Threat: FBI Supervisory Special Agent Pleads Guilty to Stealing $2.4M in Crypto Seized from Nation-State Hackers and Crime Victims