Huntress launches Brute Force Sentry for RDP and SSH
Original title: Brute Force Sentry for Managed SIEM | Huntress
Brute Force Sentry detects successful logins after failed attempts on exposed RDP RDWeb and SSH surfaces
Huntress introduces Brute Force Sentry for Managed SIEM customers. The tool watches internet-facing login surfaces including RDP RD Gateway RDWeb on Windows and SSH on Linux. When a run of failed logons ends in a successful login the Huntress SOC investigates. It normalizes authentication records from different platforms to detect traditional brute force distributed brute force spraying credential stuffing and username enumeration.
- Activates per organization when required telemetry flows
- Surfaces usernames including non-existent ones for enumeration
- Correlates failures across systems on the same host
Impact: Successful remote access via brute force after failed attempts
- 1.Enable Brute Force Sentry in Managed SIEM
- 2.Review exposed RDP and RDWeb portals
- 3.Monitor SSH login surfaces
- ATT&CK
- T1110 Brute Force
- Vendors
- Huntress
- Products
- Brute Force SentryManaged SIEM
From the original article
10 min read at huntress.comHuntress Managed SIEM's Brute Force Sentry turns the brute force attacks our SOC sees in the field into detections that fire earlier, with the evidence and hardening guidance partners need to close the gap.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.