Create a free account to save progress, earn certificates, and join the community.

Beginner·250 points·4 solves

RDP Failed Login Analysis

Learn to read Windows Event 4625 SubStatus codes to tell username enumeration from password guessing, and to confirm an impossible-travel compromise by correlating two otherwise-valid successful logons against geolocation, a time gap, and HR travel records while ruling out benign false positives.

The vulnerability

The RD Gateway host FIN-RDS-01 was hit overnight and a single external source both probed it and eventually logged in. All evidence sits in /var/log/soc. The Windows Security log security-events.json (mirrored in security-events.txt) is the core evidence file: every 4625 failure carries a SubStatus value that says why the logon failed, and Windows deliberately renders more than one of those causes with identical FailureReason text, so a count taken from the message string silently merges attack phases that are not the same thing. logon-failure-codes.md decodes the SubStatus values and explains how impossible travel is assessed and where that assessment goes wrong. geoip-lookup.csv resolves source addresses to countries and carries the great-circle distances and cruising speed the arithmetic needs. asset-inventory.csv holds the hosts, staff, HR travel records and lockout policy that let you rule the benign case out. This host also neutralises the tells from earlier labs: logon type 10 is normal because it is a remote desktop server, and external source addresses are normal because staff connect from home and while abroad. The compromise is invisible in any single event and appears only when the successful logons of one account are compared against each other.

Your tasks

Break the failures down by SubStatus

Filter security-events.json for EventID 4625 and build a histogram of the SubStatus values. Three distinct codes come back. Look each one up in logon-failure-codes.md and name the attack phase it represents. Then print SubStatus and FailureReason side by side and note which codes share a message, because any tool or filter reading the message instead of the code cannot separate those phases.

Count names, not events

Take the SubStatus that means the account does not exist and pull TargetUserName from each of those events. The same names repeat, so a line count is not the answer - collapse to unique values with sort -u first. Then compare that list against the staff recorded in asset-inventory.csv and against the names appearing under the other codes, and decide which run is a generic wordlist and which is not. That difference tells you how the attacker got hold of real names.

Look for successes, not failures

Stop counting 4625s. List the successful 4624 logons whose IpAddress falls outside the corporate 10.x ranges recorded in asset-inventory.csv. Four come back. An external address is not by itself a finding on an internet-facing RDP host - staff connect from home and while abroad, and HR has approved travel recorded for at least one account here. Check asset-inventory.csv for every account on that list before treating any of them as suspicious.

Confirm or dismiss impossible travel

For each account on that list, pull every successful 4624 it recorded that day, internal logons included - the pair that matters may straddle the corporate boundary. Resolve each source address in geoip-lookup.csv, then work out the elapsed minutes between consecutive logons by the same account and test each pair against the distances and cruising speed printed at the foot of that file. Before calling anything impossible travel, rule out the innocent explanations: where the corporate VPN pool exits, what HR has recorded for the account in asset-inventory.csv, and the geolocation caveats in logon-failure-codes.md. Only one pair survives all three checks.

Map it to MITRE ATT&CK

RDP appears in more than one ATT&CK technique and the correct one depends on where the service sits. Check asset-inventory.csv for how the RD Gateway host is exposed, then decide from the evidence whether RDP was the way in from outside or a means of moving between hosts already inside the network. Pick the technique and tactic that match that, not the one that merely mentions RDP.

Answer the questions

Start the lab, investigate the evidence in the terminal, and answer the questions here.

Hints

Loading…

Official write-upPro

Loading…

RDP Failed Login Analysis — Hands-on Lab | Codelivly