RDWeb Brute Force via Repeated 401/302 Auth Failures from Single IP
Detects high-frequency authentication failure events targeting the Microsoft Remote Desktop Web (RDWeb) access login page, indicating a potential brute force or password spraying attack against remote access services.
Splunk (SPL)
