# Brute Force Attacks Against Internet-Exposed RDP/RD Gateway/RDWeb, SSH and macOS Logins (Huntress Brute Force Sentry)

> Huntress describes brute force, distributed brute force, credential spraying, credential stuffing and username enumeration against internet-facing login surfaces (RDP, RD Gateway, RDWeb, SSH, macOS), and a Managed SIEM detection (Brute Force Sentry) that flags a successful login following such attempts. A June 2026 incident saw roughly 1,700 attempted logins across eight accounts in 72 seconds, ending in a successful compromise.

- **Published:** 2026-11-07T00:10:31Z
- **Last reviewed:** 2026-11-07T00:10:31Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5457
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5457.png
- **ID:** TL-2026-5457
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 7 (3 shown free below)

## Description

This record documents a generic, ongoing credential-attack pattern rather than a single named campaign. The primary source is a Huntress product and detection announcement published 2026-11-06. It names no CVE, threat actor, malware family or network indicators.

The source distinguishes five attack variants against internet-exposed authentication surfaces. Traditional brute force is a single source hammering a few accounts. Distributed brute force uses many sources per account so each source looks inconspicuous. Credential spraying tests common credentials across many accounts. Credential stuffing replays username/password pairs from previous breaches. Username enumeration probes accounts that do not exist. Targeted services are RDP, RD Gateway, RDWeb (Windows), SSH (Linux) and macOS authentication.

Huntress states that RDP is involved in 10-20% of the ways advanced attackers break into networks. In a June 2026 case study, eight accounts each received about 212-215 failed logons (about 1,700 attempts in 72 seconds) before a successful compromise. In a review of 30 confirmed RDWeb/RD Gateway compromises during the first four weeks of testing, Huntress says earlier detection of up to one hour would have been possible in 20 of them.

Brute Force Sentry normalizes authentication telemetry across platforms: Windows Security events 4624, 4625, 4740 and 4776, Linux sshd logs, RD Gateway connection logs and macOS native authentication records. It uses platform-specific tuning instead of generic threshold rules and alerts when a successful login follows brute-force-style activity. It is included with Huntress Managed SIEM and activates automatically once Windows authentication telemetry flows.

Related public reporting (BleepingComputer, 2026-03-04) describes a separate March 2026 Huntress Tactical Response case in which a routine brute-force alert on an exposed RDP server led to a ransomware-as-a-service initial-access infrastructure; the account was compromised from multiple IP addresses, followed by domain enumeration and credential hunting (Procdump, Mimikatz, Secretsdump). Those details belong to that case and are recorded here only as related context. MITRE ATT&CK detection strategy DET0463 for T1110 likewise calls for correlating many failed logons with a subsequent success.

Severity (MEDIUM) and status (MONITORING) are analyst-assigned and are not stated in the source. No attribution, motivation or affected product versions are given. Defender takeaways from the source: enforce MFA on exposed portals, place RD Gateway behind a VPN rather than exposing it directly, monitor internet-facing authentication, and rotate shared or legacy credentials.

## MITRE ATT&CK

- T1110 Brute Force
- T1110.001 Password Guessing
- T1110.003 Password Spraying
- T1110.004 Credential Stuffing
- T1133 External Remote Services
- T1078 Valid Accounts
- T1021.001 Remote Services: Remote Desktop Protocol
- T1021.004 Remote Services: SSH
- T1589 Gather Victim Identity Information

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Brute Force Burst Followed by Successful Logon on Exposed RDP/RD Gateway/RDWeb (T1110) — Exploitation** (`TL-2026-5457-SPL-001`)

Behaviour-first Splunk search for the Brute Force Sentry condition: 20 or more Windows Security Event ID 4625 failed network/RDP logons from one source against one account, followed by a 4624 success in the same 30-minute window. Matches the June 2026 pattern (about 212-215 failures per account before compromise). Indicates exposed-login brute force (T1110.001) ending in valid account use (T1078, T1133).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1110, T1110.001, T1078, T1133
- **Data sources:** wineventlog:security (index=wineventlog), windows_security 4624/4625
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=wineventlog sourcetype="WinEventLog:Security" (EventCode=4625 OR EventCode=4624) Logon_Type IN (3,10) earliest=-30m@m
```TL-2026-5457 T1110: burst of 4625 failures followed by a 4624 success from the same source and account (Brute Force Sentry condition)```
| eval target_user=lower(mvindex(Account_Name,-1)), src=Source_Network_Address
| where isnotnull(src) AND NOT match(src,"^(-|::1|127\.0\.0\.1)$") AND NOT match(target_user,"\$$")
| stats count(eval(EventCode=4625)) AS failures, count(eval(EventCode=4624)) AS successes, min(eval(if(EventCode=4625,_time,null()))) AS first_fail, max(eval(if(EventCode=4624,_time,null()))) AS last_success, values(Logon_Type) AS logon_types, values(host) AS hosts by src, target_user
| where failures>=20 AND successes>=1 AND last_success>first_fail
| eval first_fail=strftime(first_fail,"%F %T"), last_success=strftime(last_success,"%F %T")
| table src, target_user, hosts, failures, successes, logon_types, first_fail, last_success
````

### Microsoft KQL

```kql
// TL-2026-5457 T1110 / T1078: failed-logon burst followed by success (RDP, RD Gateway, RDWeb network logons)
let lookback = 1h;
let failThreshold = 20;
SecurityEvent
| where TimeGenerated > ago(lookback)
| where EventID in (4625, 4624) and LogonType in (3, 10)
| where isnotempty(IpAddress) and IpAddress !in ("-", "::1", "127.0.0.1")
| where TargetUserName !endswith "$"
| summarize failures = countif(EventID == 4625), successes = countif(EventID == 4624),
    firstFail = minif(TimeGenerated, EventID == 4625), lastSuccess = maxif(TimeGenerated, EventID == 4624),
    logonTypes = make_set(LogonType) by IpAddress, TargetUserName, Computer
| where failures >= failThreshold and successes >= 1 and lastSuccess > firstFail
| project IpAddress, TargetUserName, Computer, failures, successes, logonTypes, firstFail, lastSuccess
```

### Sigma

```yaml
title: Failed Network/RDP Logon Burst Against Exposed Login Surface
id: 3f6a1c52-7b0e-4d8a-9c41-5e2b8d7a1f01
name: tl_5457_win_failed_exposed_logon
status: experimental
description: Windows Security 4625 failed logons of type 3 (network, RD Gateway/RDWeb) or 10 (RemoteInteractive, RDP). The paired correlation fires on 20 or more failures per source and account in 5 minutes, the brute-force burst preceding a successful compromise (TL-2026-5457).
references:
    - https://www.huntress.com/blog/brute-force-sentry
    - https://attack.mitre.org/techniques/T1110/
    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-07
tags:
    - attack.credential-access
    - attack.t1110
    - attack.t1110.001
    - attack.initial-access
    - attack.t1133
    - attack.t1078
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4625
        LogonType:
            - 3
            - 10
    filter_local:
        IpAddress:
            - '-'
            - '::1'
            - '127.0.0.1'
    filter_machine_account:
        TargetUserName|endswith: '$'
    condition: selection and not 1 of filter_*
falsepositives:
    - Users with expired or mistyped passwords and misconfigured services or scheduled tasks using stale credentials
    - Vulnerability scanners and monitoring probes authenticating to RDP
level: medium
---
title: Brute Force Burst Against Exposed Login Surface (20+ Failures in 5 Minutes)
id: 3f6a1c52-7b0e-4d8a-9c41-5e2b8d7a1f02
status: experimental
description: Correlation of tl_5457_win_failed_exposed_logon, 20 or more failures from one source against one account within 5 minutes.
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-07
tags:
    - attack.credential-access
    - attack.t1110
correlation:
    type: event_count
    rules:
        - tl_5457_win_failed_exposed_logon
    group-by:
        - IpAddress
        - TargetUserName
    timespan: 5m
    condition:
        gte: 20
falsepositives:
    - Service accounts with stale credentials retrying aggressively
level: high

```

**Known false positives:**

- Service accounts or scheduled tasks retrying with stale credentials before a valid logon
- Users who mistype passwords repeatedly and then log on successfully
- Vulnerability scanners and monitoring probes against RDP

**Tuning notes:** Raise or lower the failure threshold (20) per baseline; allowlist known scanner and VPN egress addresses; add a 4776 join on domain controllers; for the 72-second burst pattern add a bin _time span=2m variant. Adjust the index name to your Splunk Windows inputs.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Sentinel: Failed Logon Burst Then Success on Exposed RDP/RDWeb/RD Gateway (T1110) — Exploitation (locked: unlock with TL Creds)
- Sentinel: Distributed Brute Force and Password Spraying on Exposed Logins (T1110.003/T1110.004) — Post-Exploitation Recon/Spray (locked: unlock with TL Creds)
- Sentinel: sshd Failed Logons Followed by Accepted Login on Linux (T1110.001 / T1021.004) — Lateral Access (locked: unlock with TL Creds)
- Sigma: Failed Network/RDP Logon Burst Against Exposed Login Surface (T1110) — Exploitation (locked: unlock with TL Creds)
- Sigma: Lockout and NTLM Validation Failures Indicating Password Spraying (T1110.003) — Post-Exploitation Recon/Spray (locked: unlock with TL Creds)
- Sigma: RDP Logon Activity From IPs Tied to Related Huntress RDP Brute-Force Case (T1021.001) — Lateral Access (locked: unlock with TL Creds)
- Password Spraying, Credential Stuffing and Username Enumeration Against Windows Logins (T1110.003) — Post-Exploitation Recon/Spray (locked: unlock with TL Creds)
- SSH Brute Force Followed by Accepted Login on Linux (T1110.001 / T1021.004) — Lateral Access (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 7)

Defanged, TLP:CLEAR.

- IP address: `64.190.113[.]159`
- Domain: `nologs[.]club`
- IP address: `147.135.36[.]162`

Full set of 7 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Introducing Brute Force Sentry: See Who's Knocking on Your Exposed Logins, and Know When One Gets In](https://www.huntress.com/blog/brute-force-sentry)
- [How a Brute Force Attack Unmasked a Ransomware Infrastructure Network (BleepingComputer, Huntress Tactical Response)](https://www.bleepingcomputer.com/news/security/how-a-brute-force-attack-unmasked-a-ransomware-infrastructure-network/)
- [CISA: ACSC Releases Advisory on Password Spraying Attacks](https://www.cisa.gov/news-events/alerts/2019/08/08/acsc-releases-advisory-password-spraying-attacks)
- [MITRE ATT&CK T1110 Brute Force (detection strategy DET0463)](https://attack.mitre.org/techniques/T1110/)
- [MITRE ATT&CK T1110.003 Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
- [MITRE ATT&CK T1133 External Remote Services](https://attack.mitre.org/techniques/T1133/)
- [MITRE ATT&CK T1021.001 Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001/)
- [MITRE ATT&CK T1078 Valid Accounts](https://attack.mitre.org/techniques/T1078/)
- [Microsoft: Event 4625 - An account failed to log on](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5457