Backtrace in Time: Revealing Attackers’ Sleep Patterns and Days Off in RDP Brute-Force Attacks with Calendar Heatmaps

No ratings

Presented at Shmoocon 2024 by

Andréanne Bergeron

Brute-force authentication attacks on RDP, often automated and shared among malicious actors, escalate in danger when coupled with human motivation, transitioning from opportunistic to targeted attacks. Our team deployed high-interaction honeypots and analyzed, for this presentation, 3.4 million login attempts over three months. The objective was to observe the different strategies of brute-forcing attack by malicious actors who try to compromise our systems. Human behaviors were revealed through the data, so we developed a visualization tool to help present the intricating results. Our distinctive approach involves a calendar heatmap, visually unraveling human behaviors behind brute-force attacks over time. This calendar analysis reveals four key behaviors, illustrating diverse threat actors and strategies. Identifying and differentiating human behavior is crucial for crafting robust protection measures and the criminological lens of this presentation emphasizes the human element. The bigger objective of our research program is to unravel attacker behaviors to disrupt practices and escalate the cost of malicious endeavors