Malicious activity

AWS GuardDuty detects RDP brute force attempts on an exposed unpatched Windows instance

Risk Level

Imminent Compromised (2)

Compliance Frameworks


Brute force attempts were detected by AWS GuardDuty service on the Internet facing Unpatched Windows EC2 instance {AwsEc2Instance} ({AwsEc2Instance.InstanceId}). AWS GuardDuty is a threat detection service that continuously monitors your AWS accounts and workloads for malicious activity. The service detects one of the following types of brute force attempt (Impact:EC2/WinRMBruteForce, UnauthorizedAccess:EC2/RDPBruteForce) on an EC2 instance that Orca has identified as exposed to the Internet and with an OS that hasn't been patched in a long time.