Advanced threat predictions for 2023
We polled our experts from the GReAT team and have gathered a small number of key insights about what APT actors are likely to focus on in 2023. Continue reading Advanced threat predictions for 2023
Category Archives: RDP
RDP Brute Force Attacks
I’ve discovered my VPS server with RDP access is getting attacked.
Event log shows a bunch of 4625 events.
Now I know for using RDP, this is just the nature of things.
I have changed the RDP port right from the start (I know it won’t preve… Continue reading RDP Brute Force Attacks
Is RDP wrapper any more or less secure than the built-in RDP? [closed]
I have read several sources indicating that RDP may have some vulnerabilities.
Without delving into that, is RDP wrapper any more or less secure than the built-in RDP, when it is enabled?
I read several sources, including (see below) 1) th… Continue reading Is RDP wrapper any more or less secure than the built-in RDP? [closed]
X11 forwarding to another user. How it’s possible?
I would like to understand how the following problem is technically possible:
In my company, we have a machine which I and several colleagues connect to. I regularly use x11 forwarding when I connect via SSH. (I receive the data with XQuar… Continue reading X11 forwarding to another user. How it’s possible?
How to Fix the “Remote Desktop Connection – An Internal Error Has Occurred” Error
The “Remote Desktop Connection: an internal error has occurred” message… Continue reading How to Fix the “Remote Desktop Connection – An Internal Error Has Occurred” Error
How is RDP through VPN safer?
I’ve read that I shouldn’t open RDP ports on my router (obviously with port forwarding, I don’t mean opening 3389 port directly). Instead I should use something like VNC (I get that solution) or create a VPN connection and then use RDP loc… Continue reading How is RDP through VPN safer?
How much does access to corporate infrastructure cost?
What cybercriminals charge for the data of large companies on the dark web – a review of underground forum offers by category. Continue reading How much does access to corporate infrastructure cost?
Intruder dwell time jumps 36%
Sophos released the Active Adversary Playbook 2022, detailing attacker behaviors that Sophos’ Rapid Response team saw in the wild in 2021. The findings show a 36% increase in dwell time, with a median intruder dwell time of 15 days in 2021 versus 11 da… Continue reading Intruder dwell time jumps 36%
How to get the list of computers a user can RDP into using BloodHound?
Using bloodhound I would like to find the list of all computers a user I.e "domain\ajohn" can RDP into.
I looked at:
match p=(g:Group)-[:CanRDP]->(c:Computer) where g.objectid ENDS WITH ‘-513’ AND NOT c.operatingsystem CONTAI… Continue reading How to get the list of computers a user can RDP into using BloodHound?
Verizon 2022 DBIR: External attacks and ransomware reign
There has been an alarming rise (13%) in ransomware breaches – a jump greater than the past 5 years combined, Verizon Business has revealed in its 2022 Data Breach Investigations Report (2022 DBIR). Verizon Business 2022 DBIR: Key findings Verizo… Continue reading Verizon 2022 DBIR: External attacks and ransomware reign