New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Detecting Rdp Brute Force Attacks

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Detect RDP brute force attacks by parsing Windows Security Event Logs (EVTX files, via python-evtx) for failed logon patterns (Event ID 4625, Logon Type 10/3), correlating with successful logons…

Apache-2.0Auto-check passedSecurity

Install Detecting Rdp Brute Force Attacks

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-rdp-brute-force-attacks -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-rdp-brute-force-attacks --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/detecting-rdp-brute-force-attacks .claude/skills/detecting-rdp-brute-force-attacks && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
detecting-rdp-brute-force-attacks
GitHub stars
34k
Token cost
~779 tokens
SKILL.md length
311 words
Files
4 (incl. scripts, references)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Detect RDP brute force attacks by parsing Windows Security Event Logs (EVTX files, via python-evtx) for failed logon patterns (Event ID 4625, Logon Type 10/3), correlating with successful logons…

  • Works in 4 steps: Export Security Event Logs → Parse Failed Logon Events → Analyze Attack Patterns → …
  • Investigating exposed RDP endpoints
  • SKILL.md covers Overview, When to Use, Prerequisites and Steps, plus 1 more section
  • Runs Python scripts from its folder

What it does

Detecting Rdp Brute Force Attacks is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Detect RDP brute force attacks by parsing Windows Security Event Logs (EVTX files, via python-evtx) for failed logon patterns (Event ID 4625, Logon Type 10/3), correlating with successful logons (Event ID 4624), and analyzing NLA failures and source IP frequency. Use when investigating exposed RDP endpoints, building SIEM detection rules for credential guessing, or confirming whether a compromised account followed a brute-force pattern.

Its SKILL.md is about 780 tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including scripts and reference files (for example `references/api-reference.md` and `scripts/agent.py`).

It sits in Security, covering Security operations. It works with Python. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Investigating exposed RDP endpoints
  • Building SIEM detection rules for credential guessing
  • Confirming whether a compromised account followed a brute-force pattern

Example prompts

  • “/detecting-rdp-brute-force-attacks”

Requirements

  • Python 3

Workflow steps

4 steps, taken from the step headings in SKILL.md.

  1. Export Security Event Logs
  2. Parse Failed Logon Events
  3. Analyze Attack Patterns
  4. Generate Detection Report

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 1 file in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Detecting Rdp Brute Force Attacks loads about 779 tokens when it runs, and up to ~1.3k if it reads all its reference files. Until then it costs about 119 tokens; SKILL.md has 311 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~119
When it runs · the whole SKILL.md, loaded when a task matches
~779
With references · SKILL.md plus every file in references/, read only if the agent opens them
~1.3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 311 words, ~779 tokens.

Download SKILL.mdSave it as .claude/skills/detecting-rdp-brute-force-attacks/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.
name
detecting-rdp-brute-force-attacks
description
Detect RDP brute force attacks by parsing Windows Security Event Logs (EVTX files, via python-evtx) for failed logon patterns (Event ID 4625, Logon Type 10/3), correlating with successful logons (Event ID 4624), and analyzing NLA failures and source IP frequency. Use when investigating exposed RDP endpoints, building SIEM detection rules for credential guessing, or confirming whether a compromised account followed a brute-force pattern.
domain
cybersecurity
subdomain
threat-detection
tags
threat-detection, rdp, brute-force, windows-event-logs, blue-team, siem
version
1.0
author
mahipal
license
Apache-2.0
nist_csf
DE.CM-01, DE.AE-02, DE.AE-06, ID.RA-05
mitre_attack
T1021.001, T1110.001, T1110.003, T1078

Detecting RDP Brute Force Attacks

Overview

RDP brute force attacks target Windows Remote Desktop Protocol services by attempting rapid credential guessing against exposed RDP endpoints. Detection relies on analyzing Windows Security Event Logs for Event ID 4625 (failed logon with Logon Type 10 or 3) and correlating with Event ID 4624 (successful logon) to identify compromised accounts. This skill covers parsing EVTX files with python-evtx, identifying attack patterns through source IP frequency analysis, detecting NLA bypass attempts, and generating actionable detection reports.

When to Use

  • When investigating security incidents that require detecting rdp brute force attacks
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Python 3.9+ with python-evtx, lxml libraries
  • Windows Security EVTX log files (exported from Event Viewer or collected via WEF)
  • Understanding of Windows authentication Event IDs (4624, 4625, 4776)
  • Familiarity with RDP Logon Types (Type 3 for NLA, Type 10 for RemoteInteractive)

Steps

Step 1: Export Security Event Logs

Export Windows Security logs to EVTX format using Event Viewer or wevtutil:

wevtutil epl Security C:\logs\security.evtx
Step 2: Parse Failed Logon Events

Use python-evtx to parse Event ID 4625 entries, extracting source IP, target username, failure reason (Sub Status), and Logon Type fields.

Step 3: Analyze Attack Patterns

Identify brute force patterns by:

  • Counting failed logons per source IP within time windows
  • Detecting username spray attacks (many usernames from one IP)
  • Correlating 4625 failures with subsequent 4624 success from same IP
Step 4: Generate Detection Report

Produce a JSON report with top attacking IPs, targeted accounts, time-based analysis, and compromise indicators.

Expected Output

JSON report containing:

  • Total failed logon events and unique source IPs
  • Top attacking IPs ranked by failure count
  • Targeted usernames and failure sub-status codes
  • Successful logons following brute force attempts (potential compromises)
  • Time-series analysis of attack intensity

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 3 other files (scripts, references) in skills/detecting-rdp-brute-force-attacks of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • references/api-reference.md
  • scripts/agent.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Detecting Rdp Brute Force Attacks next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Detecting Rdp Brute Force Attacks compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Detecting Rdp Brute Force Attacks this skillmukul975/Anthropic-Cybersecurity-Skills34k—~779Automated safety check: PassApache-2.0
Security Alert Triageelastic/agent-skills5921 repos~3.5kAutomated safety check: NotesApache-2.0
Kubernetes Network Security Auditkubeshark/kubeshark12k—~7.3kAutomated safety check: NotesApache-2.0
C To AstNarwhal-Lab/MagicSkills316—~1.1kAutomated safety check: PassMIT
Security Detection Rule Managementelastic/agent-skills5921 repos~3.9kAutomated safety check: NotesApache-2.0
Security AuditTheDecipherist/claude-code-mastery550—~1.3kAutomated safety check: NotesMIT

Similar skills

  • Security Alert Triage

    elastic/agent-skills

    Official

    Triage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge.

    592 GitHub starsUsed in 1 repo~3.5k tokens
    SecurityAuto-check: notes

  • Kubernetes Network Security Audit

    kubeshark/kubeshark

    Hunts for compromised workloads and malicious traffic in a Kubernetes cluster by sweeping network data through Kubeshark MCP, mapped to MITRE ATT&CK.

    12k GitHub stars~7.3k tokensUpdated 2 days ago
    SecurityAuto-check: notes

  • C To Ast

    Narwhal-Lab/MagicSkills

    Parse C source code into an Abstract Syntax Tree (AST). An agent skill from Narwhal-Lab/MagicSkills.

    316 GitHub stars~1.1k tokensUpdated 6 mo ago
    SecurityAuto-check passed

  • Security Detection Rule Management

    elastic/agent-skills

    Official

    Create, tune, and manage Elastic Security detection rules (SIEM and Endpoint).

    592 GitHub starsUsed in 1 repo~3.9k tokens
    SecurityAuto-check: notes

  • Security Audit

    TheDecipherist/claude-code-mastery

    Checks a codebase for hardcoded secrets, vulnerable dependencies, weak input handling, weak authentication and unsafe transport settings before deployment or merge.

    550 GitHub stars~1.3k tokensUpdated 5 mo ago
    SecurityAuto-check: notes

  • Chaitin CLI

    chaitin/chaitin-cli

    A skill your agent uses when running chaitin-cli commands to manage Chaitin security products: SafeLine WAF (site management, IP blocking, ACL, policy rules, attack logs), X-Ray vulnerability…

    114 GitHub stars~15k tokensUpdated 10 days ago
    SecurityAuto-check: notes

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Works with

Categories

Questions about Detecting Rdp Brute Force Attacks

What does Detecting Rdp Brute Force Attacks do?

Detect RDP brute force attacks by parsing Windows Security Event Logs (EVTX files, via python-evtx) for failed logon patterns (Event ID 4625, Logon Type 10/3), correlating with successful logons…. Detecting Rdp Brute Force Attacks is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Detect RDP brute force attacks by parsing Windows Security Event Logs (EVTX files, via python-evtx) for failed logon patterns (Event ID 4625, Logon Type 10/3), correlating with successful logons (Event ID 4624), and analyzing NLA failures and source IP frequency.

When should I use Detecting Rdp Brute Force Attacks?

Detecting Rdp Brute Force Attacks fits situations like: investigating exposed RDP endpoints; building SIEM detection rules for credential guessing; confirming whether a compromised account followed a brute-force pattern.

How do I install Detecting Rdp Brute Force Attacks in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-rdp-brute-force-attacks -a claude-code`. Or copy the skill folder (skills/detecting-rdp-brute-force-attacks in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/detecting-rdp-brute-force-attacks in your project. Claude Code loads it when a task matches its description.

How do I install Detecting Rdp Brute Force Attacks in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-rdp-brute-force-attacks -a codex`. Or copy the skill folder (skills/detecting-rdp-brute-force-attacks in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/detecting-rdp-brute-force-attacks in your project. Codex loads it when a task matches its description.

Can I use Detecting Rdp Brute Force Attacks in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-rdp-brute-force-attacks -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/detecting-rdp-brute-force-attacks, .gemini/skills/detecting-rdp-brute-force-attacks, .github/skills/detecting-rdp-brute-force-attacks and .opencode/skills/detecting-rdp-brute-force-attacks in your project.

What does Detecting Rdp Brute Force Attacks need to run?

Going by SKILL.md and its folder, Detecting Rdp Brute Force Attacks needs Python for the scripts in its folder. Our summary lists: Python 3.

Does Detecting Rdp Brute Force Attacks access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Detecting Rdp Brute Force Attacks safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Detecting Rdp Brute Force Attacks use?

Detecting Rdp Brute Force Attacks is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Detecting Rdp Brute Force Attacks use?

About 779 tokens (SKILL.md is roughly 3.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 546 tokens, read only when the agent opens those files.

What are the alternatives to Detecting Rdp Brute Force Attacks?

Skills that share tags, products or a category with Detecting Rdp Brute Force Attacks: Security Alert Triage (elastic/agent-skills, 592 stars), Kubernetes Network Security Audit (kubeshark/kubeshark, 12k stars), C To Ast (Narwhal-Lab/MagicSkills, 316 stars) and Security Detection Rule Management (elastic/agent-skills, 592 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Detecting Rdp Brute Force Attacks?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 33,993 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.