Threat video1:00
Brute Force Sentry RDP/SSH Attacks: Detection & IOCs
About 1,700 login attempts hit exposed RDP, SSH and macOS in 72 seconds in a June 2026 incident. Ships 9 detection rules, 7 IOCs and a free Splunk SPL rule.
Read the full threat intel for Brute Force Sentry RDP/SSH Attacks: Detection & IOCs →
Chapters
- 0:00The hookRoughly 1,700 attempts in 72 seconds, breached.
- 0:04The storyJune: 1,700 guesses, eight accounts, 72 seconds.
- 0:12Attack pathAttackers enumerate accounts and launch brute-force attacks.
- 0:29AttributionNo threat actor is attributed.
- 0:33Indicators of compromise4 indicators to hunt: 2 IPs and 2 domains.
- 0:39MITRE ATT&CK techniques9 ATT&CK techniques, from reconnaissance to lateral movement.
- 0:43Remediation3 steps now: Enforce MFA on all internet-exposed portals.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Roughly 1,700 attempts in 72 seconds, breached.
0:05June: 1,700 guesses, eight accounts, 72 seconds.
0:09One succeeded. Urgent detection.
0:13Attackers enumerate accounts and launch brute-force attacks.
0:16They spray common passwords across many sources.
0:20One succeeds. They access the compromised account.
0:23They open interactive RDP or SSH sessions.
0:29No threat actor is attributed. Confidence: low.
0:344 indicators to hunt: 2 IPs and 2 domains.
0:399 ATT&CK techniques, from reconnaissance to lateral movement.
0:443 steps now: Enforce MFA on all internet-exposed portals.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.