Huntress launches Brute Force Sentry detection for Managed SIEM, targeting RDP, RD Gateway and SSH credential attacks
Huntress has made Brute Force Sentry generally available to all Huntress Managed SIEM customers, a correlation-based detection capability aimed at internet-facing authentication surfaces: RDP, RD Gateway, the RDWeb portal, Linux sshd and macOS. Rather than a single "X failed logons in Y minutes" threshold, the feature correlates a run of failed authentications with the successful logon that follows and escalates it to the Huntress SOC. Huntress states its own research attributes 10–20% of advanced attacker intrusions to RDP, and notes that RDWeb and RD Gateway authenticate at the web portal much like an SSL VPN. The announcement is product news with no vulnerability, CVE or active campaign attached, so the defensive relevance is the detection gap it describes rather than an immediate threat.
Detalhes técnicos
The detection ingests Windows Security events 4624, 4625, 4740 and 4776, the RD Gateway connection log, Linux sshd logs and macOS authentication telemetry, normalising them into a single authentication record so the same logic applies across platforms. It distinguishes traditional brute force, distributed brute force, password spraying, credential stuffing and username enumeration, and surfaces the usernames attempted — including non-existent accounts, which indicate enumeration ahead of password guessing. A key design goal is cross-provider correlation: failures logged by the Windows event log and the success logged by RD Gateway on the same host are joined into one detection. Huntress cites a June 2026 incident at an organisation running Remote Desktop Gateway where an attacker made roughly 1,700 failed logons across eight accounts (212–215 each) in 72 seconds before authenticating successfully. Reviewing 30 confirmed RDWeb/RDG compromises over four weeks of testing, Huntress says the signal would have reached the SOC up to an hour earlier in 20 cases. The vendor also highlights that compromised accounts are frequently unowned shared logins for devices, front desks or one-off integrations, with stale passwords and forgotten MFA exemptions.
Remediação
Huntress recommends placing RD Gateway/RDWeb behind a VPN or enforcing MFA, questioning whether the portal should be internet-exposed at all, rotating credentials for accounts attackers repeatedly target, and inventorying shared or service accounts with MFA exemptions. Brute Force Sentry activates per organisation automatically once the required authentication telemetry is flowing, and reports an "unavailable" state with a reason when it is not.
Linha do tempo
-
Huntress launches Brute Force Sentry detection for Managed SIEM, targeting RDP, RD Gateway and SSH credential attacks
ler a análise desta fonte ocultar
Huntress has made Brute Force Sentry generally available to all Huntress Managed SIEM customers, a correlation-based detection capability aimed at internet-facing authentication surfaces: RDP, RD Gateway, the RDWeb portal, Linux sshd and macOS. Rather than a single "X failed logons in Y minutes" threshold, the feature correlates a run of failed authentications with the successful logon that follows and escalates it to the Huntress SOC. Huntress states its own research attributes 10–20% of advanced attacker intrusions to RDP, and notes that RDWeb and RD Gateway authenticate at the web portal much like an SSL VPN. The announcement is product news with no vulnerability, CVE or active campaign attached, so the defensive relevance is the detection gap it describes rather than an immediate threat.
Technical Details
The detection ingests Windows Security events 4624, 4625, 4740 and 4776, the RD Gateway connection log, Linux sshd logs and macOS authentication telemetry, normalising them into a single authentication record so the same logic applies across platforms. It distinguishes traditional brute force, distributed brute force, password spraying, credential stuffing and username enumeration, and surfaces the usernames attempted — including non-existent accounts, which indicate enumeration ahead of password guessing. A key design goal is cross-provider correlation: failures logged by the Windows event log and the success logged by RD Gateway on the same host are joined into one detection. Huntress cites a June 2026 incident at an organisation running Remote Desktop Gateway where an attacker made roughly 1,700 failed logons across eight accounts (212–215 each) in 72 seconds before authenticating successfully. Reviewing 30 confirmed RDWeb/RDG compromises over four weeks of testing, Huntress says the signal would have reached the SOC up to an hour earlier in 20 cases. The vendor also highlights that compromised accounts are frequently unowned shared logins for devices, front desks or one-off integrations, with stale passwords and forgotten MFA exemptions.
Remediation
Huntress recommends placing RD Gateway/RDWeb behind a VPN or enforcing MFA, questioning whether the portal should be internet-exposed at all, rotating credentials for accounts attackers repeatedly target, and inventorying shared or service accounts with MFA exemptions. Brute Force Sentry activates per organisation automatically once the required authentication telemetry is flowing, and reports an "unavailable" state with a reason when it is not.