Azure VM being brute force attacked

Question

Hello all, I've had an ongoing issue of receiving connection errors when I attempted to connect to my Azure VM via RDP the past couple of weeks.

I dug into it a bit yesterday and I found hundreds of thousands of Audit failure 4625 events. It's been happening since May 13th from what I can tell. I just started up my VM about 25 minutes ago and I'm already up to almost 2100 of these events.

Does anyone have any recommendations on how to prevent these attacks from occurring?

Thanks!

![9234-bruteforce.jpg][1] [1]: /api/attachments/9234-bruteforce.jpg?platform=QnA

Answer 1

Does the VM is reachable by a Public IP and protected by a NSG with an NSG Rule that allows RDP connections?
If so it's maybe helpful to deny the RDP connection in the NSG if not needed.
Also JIT might be an option: Secure your management ports with just-in-time access

Maybe this is helpful.

Regards

Andreas Baumgarten

(Please don't forget to Accept as answer if the reply is helpful)

Answer 2

Restrict WAN connections to the VM public IP to specific SCOPE from NSG.

Enable JUSTINTIME for RDP port from Azure Security Center.

http://www.moamenhany.com