HighALERT-4204engine: heuristic

RDP Failed Logins Threshold Exceeded

analyst review

Raw alert — normalized QRadar offense

asset: vpn-gw-01
protocol: TCP :3389
src_ip: 98.79.243.215
dest_ip: 10.20.1.2
magnitude: 7/10
severity: 6/10
credibility: 7/10
relevance: 7/10
src network: external
events / flows: 3,110 / 1,916

triggered rules

▹ Auth: Multiple Login Failures From Single Source
▹ Auth: Brute Force Login Attempt

full offense JSON

{
  "offense_id": 4204,
  "description": "RDP Failed Logins Threshold Exceeded :: Brute Force targeting vpn-gw-01",
  "offense_type": "Source IP",
  "offense_source": "98.79.243.215",
  "magnitude": 7,
  "severity": 6,
  "credibility": 7,
  "relevance": 7,
  "status": "OPEN",
  "source_network": "external",
  "destination_networks": [
    "internal_corp"
  ],
  "event_count": 3110,
  "flow_count": 1916,
  "start_time": "2025-11-03T02:33:00+00:00",
  "last_updated_time": "2025-11-03T03:08:00+00:00",
  "categories": [
    "Authentication",
    "User Login Failure"
  ],
  "rules": [
    "Auth: Multiple Login Failures From Single Source",
    "Auth: Brute Force Login Attempt"
  ],
  "assigned_to": null,
  "dest_port": 3389
}

AI triage

Likely brute force: RDP Failed Logins Threshold Exceeded from external source 98.79.243.215 against vpn-gw-01 (10.20.1.2) over TCP, 3,110 events observed.

MITRE ATT&CK

T1110Brute ForceCredential Accessconfidence 92%

Alert indicators (RDP Failed Logins Threshold Exceeded; rules: Auth: Multiple Login Failures From Single Source) overlap most strongly with T1110 Brute Force among the ATT&CK shortlist.

Priority — High

Scored High based on: QRadar magnitude 7/10; source is external to the network; credibility 7/10.

Recommended next steps

1.Identify the targeted account(s) and whether any authentication succeeded.
2.If a login succeeded, treat as a confirmed compromise and reset credentials immediately.
3.Enforce/verify account lockout and MFA on the targeted service.
4.Block the source IP and hunt for the same source against other assets.

Suggested hunting query (KQL)

SecurityEvent
| where TimeGenerated > ago(24h)
| where IpAddress == "98.79.243.215" and EventID in (4625, 4624)
| summarize Failures=countif(EventID==4625), Successes=countif(EventID==4624) by Account, Computer

ATT&CK candidate shortlist — matched before the model was called, so it justifies from real technique IDs

T1110Brute Force·11T1078Valid Accounts·5.5T1547.002Authentication Package·3.5T1621Multi-Factor Authentication Request Generation·3.5T1027.004Compile After Delivery·3T1056.003Web Portal Capture·3T1201Password Policy Discovery·3