I need some help on tracking the source of these RDP access attempts on our terminal server.
Port 3389 is open on the firewall (I know this is a terrible practice. I don't want to hear advice on using a VPN for LAN access). I checked through the security audits and can see that we are getting hit just about every second with a dictionary attack. I have checked the RemoteDesktopServices-RdpCoreTS operational events for IP addresses. No IP address has had repeated entries, except for about 1 or 2.. so I believe they are spoofing the IP.
Our firewall also shows no active 3389 port connections during the attacks.
Is it possible that there is an infection on a local computer causing this? It's very confusing, but I'm still in school so am not fully equipped with knowledge.