0

I need some help on tracking the source of these RDP access attempts on our terminal server.

Port 3389 is open on the firewall (I know this is a terrible practice. I don't want to hear advice on using a VPN for LAN access). I checked through the security audits and can see that we are getting hit just about every second with a dictionary attack. I have checked the RemoteDesktopServices-RdpCoreTS operational events for IP addresses. No IP address has had repeated entries, except for about 1 or 2.. so I believe they are spoofing the IP.

Our firewall also shows no active 3389 port connections during the attacks.

Is it possible that there is an infection on a local computer causing this? It's very confusing, but I'm still in school so am not fully equipped with knowledge.

Improve this question
2
  • I assume the audit log you are looking at is from the server itself and not the firewall?
    – schroeder ♦
    Dec 13, 2017 at 17:39
  • Yes, when i am filtering through the event logs.
    – Anonymous Apprentice
    Dec 13, 2017 at 21:22

1 Answer 1

Reset to default
1

It is not likely a spoof (the attacker would not know if they were successful) but more likely a botnet cycling through its nodes to attack you. That's why it's a range of IPs. They cycle like this so that no one IP triggers a block.

Then is it also not likely that it is a local computer.

This behaviour is neither extraordinary nor unexpected. Just business as usual on the Internet. That's why exposing services like this is not recommended unless you have mitigations in place like only allowing certain IPs to connect to port 3389.

Improve this answer
2
  • Thanks for the clarification! Also, i see no active connections to the sonicwall when the attacks are happening. Is there any reason why im not? or, more specifically, is there any way to monitor such connections?
    – Anonymous Apprentice
    Dec 13, 2017 at 21:22
  • if not authenticated, then not an active session
    – schroeder ♦
    Dec 13, 2017 at 21:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .