SOC176 RDP Brute Force Detected (EventID 234) | Confirmed Compromise | LetsDefend SOC

In this video, we investigate SOC176 – RDP Brute Force Detected (EventID 234) on the LetsDefend platform.

This alert highlights a real credential compromise scenario, where an external attacker successfully brute-forced RDP access to a Windows host.

🔍 Investigation Summary
🧠 MITRE ATT&CK

T1110 – Brute Force

T1078 – Valid Accounts

👤 WHO

External attacker from IP 218.92.0.56
Target: Windows host Matthew (172.16.17.148)

⚠️ WHAT

Multiple failed RDP login attempts (Event ID 4625)

Followed by a successful login (Event ID 4624, Logon Type 10 – RemoteInteractive)

Indicates valid credentials were eventually guessed

🕒 WHEN

March 07, 2024 – approximately 11:44 AM

🌐 WHERE

RDP over TCP 3389

🔎 HOW

Repeated authentication failures from a single external IP

Followed by successful remote interactive logon

Clear brute-force pattern leading to account compromise

🚨 SOC Response & Containment

This alert was confirmed as a True Positive compromise.

Recommended actions:

Reset compromised account password

Isolate affected host from network

Block attacking IP at firewall

Review for lateral movement

Check for persistence mechanisms

Playbook steps covered:

Log Management

Traffic Analysis

IP Reputation Check

Scope Determination

Enrichment & Context

Isolation decision

🧠 What You’ll Learn

How to detect RDP brute-force attacks in logs

Interpreting Event ID 4625 vs 4624

Identifying RemoteInteractive logon types

Determining when brute-force becomes confirmed compromise

Proper SOC escalation and containment workflow

This walkthrough is ideal for SOC Level 1 analysts, blue team learners, and anyone preparing for real-world brute-force investigations.

🔐 Disclaimer

For educational and defensive security purposes only.

#SOC
#LetsDefend
#SOC176
#RDP
#BruteForce
#MITREATTACK
#BlueTeam
#SOCAnalyst
#IncidentResponse
#CyberSecurity
#LogAnalysis
#WindowsSecurity
#DFIR

Видео SOC176 RDP Brute Force Detected (EventID 234) | Confirmed Compromise | LetsDefend SOC канала InkSec