There is a computer system that has to have RDP on an open port(I fought against this of course). I secured this via RDPGuard which worked phenomenally. Anyway, after a few weeks I check back on those RDP Logs and I see a RDP login attempt originating from the loopback address, or the actual external IP Address of the server

The user it's attempting to log in as is SERVER$ and I've actually recieved log in success reports from it as well. Is this actually normal Windows behavior or did I just get pwned?

1 Answer 1


No, this is not normal behavior. Most likely, the server has been compromised, and it has a backdoor installed that forwards the connection to RDP server. Probably a reverse tunnel, given that the RDP port itself is exposed to the internet and forwarding from another port wouldn't be that useful (it would just conceal the connection a bit).

I would try to find out the backdoor, so you have evidence to present that the server was indeed compromised, then wipe & reinstall the server and use the experience to get that the RDP not published. If someone really needs to RDP to that server from outside the company, that should be secured over a VPN. If you hadn't noticed the compromise in the log, your first notice could be when you come and find the server ransomwared. Or that internal information have been leaked through it (in fact, who knows that they already did...).

Good luck getting that improved

  • This is what I'm thinking too. Thank you for confirming my suspicions! :) Here's hoping its just a botnet controller stealing my cpu cycles.
    – Mig S.
    Commented Jun 13, 2019 at 0:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .