Backtrace in Time

The talk looks at brute-force attacks against a deliberately exposed Windows machine with Remote Desktop enabled and no lockout policy. The researcher explains that a recording tool captured attacker sessions, showing what intruders typed, pasted and ran once inside. Most login attempts tried a small set of usernames, with variations of administrator the most common, and many passwords were built from details of the host itself, which suggests some attackers gathered system information before guessing.

The main focus is timing. Working from roughly 190,000 logged login attempts, the researcher plotted activity by day and hour. Only a small share of source addresses attacked continuously. Many showed a clear gap on weekends, which the researcher links to operators working office-style schedules, and a recurring quiet window of about eight hours that may match a daytime job or sleep. A look at holiday periods found no reliable surge once traffic from Russian-origin addresses was separated out. Activity from that group did spike at several points across the year, not only during the holidays.

The practical takeaway is that timing patterns could help defenders decide when to staff monitoring and when to expect quieter periods. The speaker stresses the findings come from one US address and one unrestricted system, so they do not describe all attacker behavior at all times. The session closes with a short question round about the plotting tools used to build the visualizations.