How to detect an RDP brute-force attack from failed logons
A run of failed Remote Desktop sign-ins is often the first sign of a brute-force attack. This guide shows how to read event 4625 in the Security log and how to spot the pattern across servers.