BruteCatch monitors failed logon attempts across RDP, FTP, SSH, MS-SQL, HTTP, and VPN - automatically banning attackers via Windows Firewall. Set it up in 2 minutes, forget about it forever.
BruteCatch watches every common attack surface on your Windows server - not just RDP.
Failed & successful RDP session monitoring
Windows FTP & IIS FTP brute-force detection
IIS web application authentication attacks
Remote Desktop Gateway web portal attacks
SQL Server login brute-force attempts
Windows OpenSSH failed authentication
Routing & Remote Access VPN attacks
New protocols added with updates
Install it, configure your policy, and let it work. No cloud, no subscriptions, no agents phoning home.
Blocks ALL ports for attacking IPs using Windows Firewall. Not just RDP - the attacker is completely locked out.
Hooks directly into Windows Event Log. Detects and bans within milliseconds of exceeding your threshold.
Monitors successful RDP logons. If someone unauthorized logs in, BruteCatch force-logs them off instantly.
Every ban, unban, whitelist change, and policy update is logged. Complete visibility for compliance.
Whitelist entire subnets with CIDR notation. Adding an IP to the whitelist auto-removes any active bans.
Runs entirely on your server. No cloud dependency, no telemetry, no data leaving your network. Ever.
Configure threshold, detection window, ban duration. Recommendation-only mode for testing before enforcement.
Beautiful WPF desktop app with live dashboard, event feed, and right-click actions. Manage everything visually.
Fully self-contained. No runtime to install, no Java, no Python, no frameworks. Just run the installer.
A clean, professional management console that shows you exactly what's happening on your server.
Download and run the setup. Installs the service + desktop app. Requires admin rights.
Set your threshold (e.g. 6 failures in 5 min), ban duration, and which protocols to monitor.
Turn off "Recommendation Only" mode. BruteCatch starts creating firewall rules automatically.
The service runs 24/7 as a Windows Service. Auto-bans, auto-expires, auto-cleans up.
Buy once, own forever. Every license includes 12 months of free updates.
Download and run BruteCatch_Setup_1.0.0.exe. The installer requires admin privileges and will:
After installation, open the BruteCatch Desktop App. It will automatically connect to the agent service running on your machine. Use the built-in Simulator to test detection before enabling enforcement.
| Requirement | Details |
|---|---|
| OS | Windows Server 2016+ or Windows 10/11 |
| Privileges | Administrator (for firewall management) |
| Runtime | None - fully self-contained, no dependencies |
| Disk | <50 MB + database growth |
All settings are configured through the Desktop App - no config files to edit manually.
| Setting | Default | Description |
|---|---|---|
| Failed login threshold | 6 | Failed attempts before auto-ban |
| Detection window | 5 min | Sliding window for counting failures |
| Ban duration | 30 min | How long the firewall rule stays |
| Recommendation-only | ON | Logs threats without banning |
Important: The default policy ships with Recommendation-only mode ON. This lets you verify detection is working correctly before enabling enforcement. Disable it in Configuration to start auto-banning.
Each protocol can be independently enabled or disabled from the Monitoring page. Changes take effect within seconds. By default, only RDP monitoring is enabled - enable additional protocols as needed.
BruteCatch supports a full dry-run mode where all detection works normally, but no firewall rules are created. Perfect for initial deployment and testing on production servers.
The installer automatically registers BruteCatch as a Windows Service that starts on boot. You can manage it through the standard Windows Services console (services.msc) or via the command line:
# Check service status
sc.exe query "BruteCatch Agent"
# Stop / Start
sc.exe stop "BruteCatch Agent"
sc.exe start "BruteCatch Agent"All configuration, bans, whitelist entries, and audit history are stored in a local database. To back up, simply copy the data/ folder from the installation directory. Restore by copying it back.
BruteCatch uses Windows Firewall to block attacking IPs. Each ban creates a firewall rule that blocks ALL inbound traffic from that IP address. Rules are automatically cleaned up when bans expire.
Use the standard Windows Add/Remove Programs to uninstall. The uninstaller will stop and remove the service. You'll be asked if you want to keep or delete your database (ban history, whitelist, etc.).
When running as a service, logs go to the Windows Event Log under Application source. For detailed logging, run the agent in console mode.
The Logon Watchdog monitors successful RDP logons (Event ID 4624, LogonType 10) and enforces an authorized-user policy.
| Mode | Behavior |
|---|---|
| Dry-run (default) | Logs unauthorized logons in the audit trail. No action taken. Recommended for initial setup. |
| Enforce | Automatically detects the unauthorized session and force-logs the user off immediately. |
Usernames are automatically normalized - you can enter them in any format:
johnDOMAIN\johnjohn@domain.comAll formats are normalized automatically. System and service accounts are ignored.
One-time purchase. No subscriptions. No cloud dependency. Just solid, local protection.
Get BruteCatch - from $59