Detect RDP brute force attacks by analyzing Windows Security Event Logs for failed authentication patterns (Event ID 4625), successful logons after failures (Event ID 4624), NLA failures, and source IP frequency analysis.
Automate repetitive workflows and reduce manual effort
Example: Generate reports, summarize documents, draft communications
Save 3-5 hours per week on routine tasks
Learn new skills, understand complex topics, get expert guidance
Example: Explain concepts, provide examples, suggest learning resources
Accelerate learning and skill development by 2x
Enhance output quality through reviews, suggestions, and refinements
Example: Review drafts, suggest improvements, catch errors
Improve work quality by 30-40% with less effort
Time estimate: 15-45 minutes depending on use case complexity
Prerequisites
Submit your Claude Code skill and start earning
epx add mukul975/Anthropic-Cybersecurity-Skills/detecting-rdp-brute-force-attacksCompatible with
Supported agents
| name | detecting-rdp-brute-force-attacks |
| description | Detect RDP brute force attacks by analyzing Windows Security Event Logs for failed authentication patterns (Event ID 4625), successful logons after failures (Event ID 4624), NLA failures, and source IP frequency analysis. |
| domain | cybersecurity |
| subdomain | threat-detection |
| tags | - threat-detection - rdp - brute-force - windows-event-logs - blue-team - siem |
| version | '1.0' |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | - DE.CM-01 - DE.AE-02 - DE.AE-06 - ID.RA-05 |
RDP brute force attacks target Windows Remote Desktop Protocol services by attempting rapid credential guessing against exposed RDP endpoints. Detection relies on analyzing Windows Security Event Logs for Event ID 4625 (failed logon with Logon Type 10 or 3) and correlating with Event ID 4624 (successful logon) to identify compromised accounts. This skill covers parsing EVTX files with python-evtx, identifying attack patterns through source IP frequency analysis, detecting NLA bypass attempts, and generating actionable detection reports.
python-evtx, lxml librariesExport Windows Security logs to EVTX format using Event Viewer or wevtutil:
wevtutil epl Security C:\logs\security.evtx
Use python-evtx to parse Event ID 4625 entries, extracting source IP, target username, failure reason (Sub Status), and Logon Type fields.
Identify brute force patterns by:
Produce a JSON report with top attacking IPs, targeted accounts, time-based analysis, and compromise indicators.
JSON report containing:
AI-first code editor with Composer
Before installing skills in Cursor, ensure your development environment meets these requirements:
node --versiondetecting-rdp-brute-force-attacksExecute the skills CLI command in your project's root directory to begin installation:
epx add mukul975/Anthropic-Cybersecurity-Skills/detecting-rdp-brute-force-attacksFetches detecting-rdp-brute-force-attacks from mukul975/Anthropic-Cybersecurity-Skills and configures it for Cursor.
The CLI shows a list of agents. Use arrow keys and space to select Cursor:
Confirm successful installation by checking the skill directory location:
.cursor/skills/detecting-rdp-brute-force-attacks
Restart Cursor to activate detecting-rdp-brute-force-attacks. Access via /detecting-rdp-brute-force-attacksin your agent's command palette.
Learn more:View source on GitHubSkills CLI docsAbout CursorWhat are agent skills?
Steps
Common Pitfalls
✓ Do
✗ Don't
💡 Pro Tips
✓ Use when
Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.
✗ Avoid when
Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.
performing-initial-access-with-evilginx3
mukul975/Anthropic-Cybersecurity-Skills · performing-initial-access-with-evilginx3 · same repo
analyzing-network-traffic-with-wireshark
mukul975/Anthropic-Cybersecurity-Skills · analyzing-network-traffic-with-wireshark · same repo
analyzing-network-traffic-for-incidents
mukul975/Anthropic-Cybersecurity-Skills · analyzing-network-traffic-for-incidents · same repo
building-red-team-c2-infrastructure-with-havoc
mukul975/Anthropic-Cybersecurity-Skills · building-red-team-c2-infrastructure-with-havoc · same repo
triaging-vulnerabilities-with-ssvc-framework
mukul975/Anthropic-Cybersecurity-Skills · triaging-vulnerabilities-with-ssvc-framework · same repo
performing-wifi-password-cracking-with-aircrack
mukul975/Anthropic-Cybersecurity-Skills · performing-wifi-password-cracking-with-aircrack · same repo
detecting-rdp-brute-force-attacks fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
detecting-rdp-brute-force-attacks reduced setup friction for our internal harness; good balance of opinion and flexibility.
I recommend detecting-rdp-brute-force-attacks for anyone iterating fast on agent tooling; clear intent and a small, reviewable surface area.
detecting-rdp-brute-force-attacks is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
I recommend detecting-rdp-brute-force-attacks for anyone iterating fast on agent tooling; clear intent and a small, reviewable surface area.
Solid pick for teams standardizing on skills: detecting-rdp-brute-force-attacks is focused, and the summary matches what you get after install.
detecting-rdp-brute-force-attacks reduced setup friction for our internal harness; good balance of opinion and flexibility.
Useful defaults in detecting-rdp-brute-force-attacks — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.
detecting-rdp-brute-force-attacks has been reliable in day-to-day use. Documentation quality is above average for community skills.
Registry listing for detecting-rdp-brute-force-attacks matched our evaluation — installs cleanly and behaves as described in the markdown.
showing 1-10 of 62