RDP Intrusion Detection
Short bio
RDP Intrusion Detection is an alert created by the Brute Force Protection setting within Malwarebytes' Nebula policy.
Malicious behavior
Repeated failed attempts may be an indication that someone is trying to get unauthorized access.
Protection
Malwarebytes blocks these repeated attempts to protect your access point against unauthorized access. More information about Brute Force Protection can be found in the KB article Configure Brute Force Protection in Malwarebytes Nebula.
Configuration
With Brute Force Protection enabled, the default setting is "monitor mode" which will trigger a Remote Intrusion Detection when your Windows Remote Desktop (RDP) sees 5 failed attempts within 5 minutes from the same IP address. You can change these settings under Policies >Default Policy>OS>Settings>Brute Force Protection.
