Recognises brute force
Repeated failed logins from the same source are treated as a pattern, not as separate events. The address is blocked.
What is open gets found
A Windows server with remote desktop facing the internet starts receiving login attempts shortly after it goes up. Not because anyone was looking for you specifically, but because someone is looking for everyone.
Why RDP is especially exposed
Remote desktop is an attractive target for a simple reason: if someone manages to log in they do not just have a foot in the door, they have the whole system. There is no intermediate step to get past.
The attacks are rarely sophisticated. They consist of large numbers of login attempts with common usernames and passwords, run automatically against every address where the port answers. Volume is the method.
Three things the client does on a server
Blocks known attackers immediately
Addresses already in the threat data never get to make a first attempt.
Records scanning
Port scans and vulnerability probing against the server are logged and blocked — often what precedes a real attempt.
Why the kernel driver matters here
On a server under load, where the blocking happens makes a difference. The driver aborts the connection as it is set up, before the service behind it has to handle it.
That means an ongoing brute-force attempt does not load the login service to the same extent, and that the blocking applies whichever program is listening on the port.
- The connection is aborted before the service handles it
- Covers all traffic on the device, not just RDP
- Works with Secure Boot enabled
- Protection can be stopped from the panel during troubleshooting
Does not replace basic hardening
WF SecurityCloud reduces the pressure considerably but does not remove the need for strong passwords, multi-factor authentication and not exposing more than necessary. If we see obvious gaps in an environment we will say so rather than sell a licence and pretend the problem is solved.
Review your server environment
Describe which services are exposed and we will say what is reasonable to do about it.