RDP Brute-Force High-Rate SYN Connections to Port 3389

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects a high frequency of incoming TCP SYN packets targeting port 3389 (RDP) from a single source within a short time window. This behavior is indicative of a brute-force or credential-stuffing attack against Remote Desktop services.